fix(issue62): integrate bounded live-control evidence hardening

[NOirBRight]

Scope

Integrates the Issue #62 manifest, sidecar correlation, and bounded runtime hardening slices on top of origin/dev@accab8ff6eb4d6ebd93cda84585fb5f6cb89da82.

This is a draft only. It does not close #62, unlock #65, or authorize any release/tag.

Implemented in this candidate

• explicit route digest and planner binding into live manifests;
• HMAC-bound pre/post capture correlation and shared key path/SHA binding;
• deterministic capture publication without overwrite races, with visible sanitized failure records;
• fail-closed zero-unclassified identity validation;
• bounded process-tree cleanup, Windows Toolhelp fallback, and conservative POSIX observed-PID readback;
• focused regression coverage.

Exact candidate head: 2d85e6e9764de6c0b6f9baaa2b47ad0ae8cb0e66.
Focused verification: 88 passed; git diff --check clean.

Remaining acceptance blockers

• complete model-visible planner inputs and per-item hosted-only/unknown dispositions;
• real current-candidate pre/post request/response/SSE evidence for all required controls;
• wire-bound mutation/deletion/loss replay and qualification coupling;
• producer/tamper binding and current-run nonce for sidecar records;
• complete detached-descendant proof for supported POSIX lanes.

Per the release gate, exact SHA review is not PASS and no CLI/Hosted gate or Beta2 tag/release may proceed until these blockers are resolved.

Refs #62

[NOirBRight]

Exact-SHA review result for HEAD fc511f4 (fixed point 2d85e6e): Standards PASS; Spec FAIL/PARTIAL. The hardening/docs slice is not Issue #62 completion. Missing gates remain: complete current-candidate model-visible planner captured before sampling; real candidate-bound pre/post request/response/SSE across required controls; non-streaming/choices/terminal/error/hosted-only/unknown evidence; wire-bound mutation/deletion/loss replay coupled to qualification; and live cleanup readback including POSIX descendant proof. Per release policy, do not run CLI/Hosted as acceptance gates and do not create v0.1.8-beta.2 tag/release until these are captured and reviewed.

[NOirBRight]

Roadmap scope changed on 2026-08-04. #62 is now limited to the exact Codex CLI 0.146 structural inventory and representative wire lifecycles needed by #65; the previous forensic-platform completion checklist is no longer a Beta2 blocker. Do not continue expanding this PR to satisfy the old #62 scope. Before any merge decision, split or identify the minimal reviewed #62 slice; remaining reusable provenance/correlation/evidence hardening is tracked by #352 for Beta7/RC. This PR remains Draft and does not close #62, unlock #58, authorize CI-first acceptance, or authorize a Beta2 tag/release.

[NOirBRight]

Superseded by the completed #62 candidate-bound live evidence and closeout recorded on Issue #62. This draft still carried explicitly non-qualifying blockers; no release claim is made.