fix: restore shared CI contract checks

[yannickmonney]

Shared CI was failing across PRs on unused exports, outdated task-review assertions, an incomplete CLI module scope and nondeterministic test fixtures. This change restores those contracts and composes them with the seven-workflow cancellation repair now on main.

• Keep internal helpers and retry data private; task review remains strictly native, with the forbidden delegated path registered and tested.
• Add the maintained request-channel dependency to CLI closure/push scope and regenerate the release descriptor through its existing contract generator.
• Drive the existing spawner-outage retry fixture with virtual time; synchronize egress fixture startup/cleanup without changing production retry ceilings or time bounds.
• Count reads of the exact staged fixture by device/inode. Linux descriptor-relative /proc/self/fd/N/c.txt opens were hashing successfully but escaped the old path-substring counter. All five cases, 19 assertions and settling-time bounds remain; daemon production is unchanged.
• Preserve main's entire seven-workflow cancellation policy and historical source profiles. The current CLI differs from the retained workflow only by the request-channel push path; its job graph is byte-equivalent. A separate exact three-file source profile covers that workflow, with tests refusing missing/changed closure files, live jobs and assigned verdict runners.

Validation: the final composition passes 249 policy cases (2210 assertions) plus 43 release-workflow cases (1873 assertions); a distinct reviewer independently reran all 249 policy cases and verified preservation. Whole configured Knip, full CLI types, scoped typed lint, format, SAST, commitlint and conflict guards pass. Twelve prior accepted blobs remain exact; the two composed cancellation helpers differ from main only by unused export demotions. Linux reproduces the original staged counter 4 pass / 1 fail versus repaired 5 pass / 0 fail, with 51 related cases/151 assertions passing and a separate independent five-case run. Prior source fixes retain their separately recorded causal and selected tests.

The hosted workspace failures on #4214, #4260, #4301 and #4643 expose one further stale Docker inventory expectation. The exact read-only docker ps call now expects the existing eighth egress-label field emitted by production. This adds one test literal; the fake Docker implementation, all 38 assertion call sites, result checks and time bounds remain unchanged. Linux reproduces 15 passes and one failure before the repair, then 16 passes with the same 59 assertions; related listing and create-call suites give 33 distinct passing cases and 102 assertions in total. A distinct reviewer independently reran the 16-case suite. All 62 sandbox production files and the 16 prior accepted repair files remain byte-identical. Full sandbox types, configured typed lint, format, conflict checks, commitlint and applicable SAST rules pass.

Root independently ran the complete maintained sandbox unit suite on exact published d18e9e25e5db55ea677a31dd453363a6cd84a3bd: 1468 tests passed, zero failed, 9912 assertions across 60 files. This used an ephemeral nonroot Linux arm64 Bun 1.4.2 container with read-only source/dependencies, no network or Docker socket; the worktree remained clean and the owned container was removed. The 33 selected cases above are a subset of this full suite, not additional distinct tests. This is local workspace proof, with hosted x64 CI and all other required workflow checks still pending.

All seven native checks remain required. Local Linux proof is arm64, not a newly observed hosted x64 CI result. The previous whole-repository check remained non-green because of unrelated timing failures/cancelled work; the passing focused and static gates do not assert a complete repository or release-candidate validation. Cancellation is never validation success, and this PR does not bypass current sources, merge groups, required checks or release gates.