fix: harden task-runner ship check and conformance guard

[Brian Krabach (bkrabach)]

Summary

Port the source-side maintenance fix from microsoft/amplifier-bundle-attractor#356 into the engine bundle:

• Harden the shipped task-runner ship_check so tracked .ai/ leaks and git status / git ls-files failures route to dirty/escalate instead of being treated as shipped.
• Update the spec-conformance guard's missing-ledger diagnostic to name the current docs/VISION.md doctrine target and add the corresponding fail-closed witness.
• Add eight real parser/ToolHandler regression cases covering clean, untracked .ai/, unexpected files, tracked .ai/, missing HEAD, command failures, .ai-prefixed neighbors, and git ls-files failure.

Source PR: microsoft/amplifier-bundle-attractor#356

Verification checklist

• Exact three-file scope; no engine production code, model pins, defaults, privacy surface, or new artifact predicate changed.
• The production DOT command matches the merged source-side command; this is a narrow port, not a vendor copy.
• Real ToolHandler coverage: 8 scenarios, including both command-failure routes and the tracked-artifact leak.
• Independent DTU/architecture/diagram review passed; evidence is private and raw host paths/logs are not uploaded.
• Existing dirty exit-zero escalation behavior is preserved.
• CI is green before merge; this PR is not authorized for merge unless all required checks are terminal success and the required review gate is satisfied.

Verification evidence

• Root source suite: 268 passed, 2 skipped; documentation guard: 9 passed.
• Full engine suite: 2335 passed, 237 skipped, with four disclosed pre-existing warnings; baseline was 2326 passed, 237 skipped with the same warning profile.
• Real installed-root CLI strict-lint/render evidence passed for both graphs. This is not a claim of a fresh full multi-hour LLM generation run.
• Scoped Ruff and DOT review passed. The port branch is based on 58d4041bd9876f8b0e15a48ae1db0c0d0519bb6f and is independent of the merged source PR's history.

Notes for reviewers

This PR is the canonical port half of source PR #356. On merge, it closes dot-runner #28 and #62; until then those issue records remain open. No publication proof or capsule PR is included here.

Generated with Amplifier

Co-Authored-By: Amplifier 240397093+microsoft-amplifier@users.noreply.github.com