Make command coverage execution-backed

[iperev]

Summary

• Keep descriptor-owned command routes as non-semantic candidates.
• Execute exact package-scoped selected Go tests from a digest-bound materialized source snapshot.
• Bind reserved lifecycle attributes and an independently authored counterfeit corpus to every public command.
• Require coverage metrics v2 and release closeout to re-admit a current command-oracle diagnostic.
• Centralize bounded repository snapshots and repository-confined artifact file operations.

Proof

• npx --yes npm@11.18.0 run check
• go test -race ./internal/tools/artifactfile ./internal/tools/repositorysnapshot ./internal/tools/commandoracle
• go test -race ./internal/tools/repositorysnapshot ./internal/tools/commandoracle ./internal/tools/packageartifactrecord ./internal/tools/releasecloseoutinput
• Self coverage: 69/69 requirements, 185 scenarios, 78 commands, 104/104 execution-backed route entries.
• git diff --check
• go run ./internal/tools/commandcontractgen --check

Boundaries

Passing selected tests does not prove assertion-branch execution, mutation adequacy, exhaustive command semantics, malicious-test resistance, producer authentication, provider admission, or production readiness. Static route metadata, prose, source markers, and test existence remain candidate evidence only.