feat: deliver Made remediation phases 1-3

[douglasjarquin]

Summary

Delivers the Made-owned remediation phases 1 through 3 from the parent plan.

Phase 1 adds red-first behavioral contracts for the versioned API, durable lifecycle and submission state, exact run identity, socket and singleton safety, strict external fakes, evidence bounds, review isolation, and real Made plus Consigliere compatibility.

Phase 2 implements the WAL-backed daemon state, fsync gate-submission spool, exact lifecycle and cancellation semantics, native structured commands, owner-authorized shutdown, batch active-run status, and durable restart recovery.

Phase 3 implements strict .made.yml decoding, trusted default refresh, supported Codex structured invocation, Made-owned review JSON validation, controlled auto-fixes, evidence redaction and publication bounds, idempotent PR and check handling, infrastructure-failure classification, and pinned CI validation.

Review agents are contained with macOS sandbox-exec or Linux bubblewrap so they cannot read or modify the delivery worktree or common Git directory.

Custody

• Base: main at 3e19ed9d598a68149da5a73949533e8095ca4403
• Head: cs/made-remediation-p1p3b at 7f9348558d1e4f635afdb50883e5600c980498c1
• Direct PR: no merge performed
• No Consigliere files, GitHub issues, default branch, or shared Made daemon were changed

Validation

The exact executable source is f2bac112fd2b91eb3bd1396878da21273961cbe0; CI configuration is finalized at 463e5805d8ba4eac8d6e72e5315cfc43f2c7782b; the report-only delivery receipt is at 7f9348558d1e4f635afdb50883e5600c980498c1.

The local deterministic validation passed go build ./..., go test ./..., go test -race -shuffle=on -count=1 ./..., go vet ./..., and pinned golangci-lint run ./... with 0 issues.

The focused API, evidence, containment, agent, rebase, and review suites passed at the exact executable source, including setuid-compatible bubblewrap launch, private read-only mask binds, and stable queued submission identity.

The real-process lifecycle, restart, gate-spool replay, duplicate singleton, obsolete-RPC rejection, and hermetic compatibility tests passed; the compatibility test used the real Made binary, the real Consigliere script, strict fake GitHub, and unavailable Herdr boundaries.

The CI workflow installs bubblewrap and enables its documented setuid execution mode so Linux containment does not require unavailable unprivileged user namespaces; protected paths use private read-only binds inside the detached review clone; and lint uses golangci/golangci-lint-action v7.0.1 at SHA 9fae48acfc02a90574d7c304a1758ef9895495fa for golangci-lint v2.11.2.

The strict Codex fake accepts only codex exec --cd <dir> --json --output-schema <schema> -.

The strict GitHub fake rejects PR URLs where workflow run IDs are required and models check status, conclusion, workflow run ID, and details URL.

The final gate, code, and QA review lanes passed at exact HEAD; the code-security review found no blocking defects and approved with a watch on duplicated containment helpers and module size.

The existing Consigliere cs_made_status helper still invokes the intentionally removed predecessor command made status --json and remains an external out-of-scope finding because this task forbids Consigliere edits and Made compatibility shims.

Delivery receipt

Direct PR #1 is open, non-draft, unmerged, and targets main at 3e19ed9d598a68149da5a73949533e8095ca4403.

Live CI run 31996198327 passed its required build-test-lint job for this exact PR head.