feat(readiness): add quality gates and harden local runtime

[echobt]

Summary

• Add Cortex CLI / Cortex Code source/dependency policies, reproducible setup and devcontainer, test timing/flakiness reports, an 80% changed-production-line coverage gate, and scheduled stability checks.
• Wire server authentication, JWT/admin authorization, middleware, request correlation, metrics, workspace file boundaries, and WebSocket reauthentication. Add opt-in private diagnostics and local-only insights, with no diagnostic uploads.
• Add generated CLI/OpenAPI contracts, real-process local functional/security QA, ownership, repository skills, and development/security/operations guidance.
• Fix feature registry initialization, conflicting CLI version/verbosity flags, stale doctests, and an append completion race exposed by workspace tests. Normalize workspace dependencies while preserving documented compatibility exceptions.
• Make clean-runner Rust components, Git/ripgrep, and coverage output setup explicit, with workflow regression tests.

This PR publishes the complete remediation branch. The already-authorized GitHub settings changes require one main-branch approval and add priority/area labels. No merge or release is requested. All checks passed on the published head. Independent review is still required.

Test plan

• cargo fmt --all -- --check
• ./scripts/clippy.sh
• cargo test --workspace, run as cargo test --locked --offline --workspace --no-fail-fast, including doctests
• TUI / snapshot tests: workspace headless suites passed; TUI source edits only repair documentation examples, with no rendering changes
• cargo audit, with existing documented exceptions unchanged
• Source/dependency policy and generated API contracts verified against the actual base 2e24cba2ed05d2833edaf06e9e1a34d0f65d6cc5
• Local functional/security QA: 14 cases passed against real CLI/server processes
• Changed-line production coverage: 750/879 executable lines, 85.32%, with no missing production files
• Three independent nextest workspace runs: 6,039 passed and 19 pre-existing skips per run; zero observed flaky tests, no retries
• 28 Python policy/workflow tests; unused-dependency, minimum-release-age, version-consistency, schema-freshness, and whitespace checks
• All 12 GitHub checks, including CI Success, pass on head ff0b9b4

The development image built and passed an unprivileged, network-disabled prerequisite smoke test. Full editor-driven post-create setup and authenticated interactive TUI/coding-service QA were not verified.

Attestation (required)

I attest that:

• Security reviewed: auth, exec/sandbox boundaries, path traversal, network egress, and secret handling in this diff were reviewed. The new diagnostics stay local. This is not a full multi-tenant sandbox audit.
• Product-facing errors: changed user-visible failure paths use Cortex product copy. API-down copy remains The coding service is temporarily unavailable. This does not claim every legacy error/log path was audited.
• TUI verified: builds and headless suites passed. Only TUI documentation examples and dependency declarations changed; no interactive UI surface changed. No authenticated live TUI turn is claimed.
• Tests added: new logic has unit/integration coverage and real-process negative/security cases. No mock-success, sleeps, retries, or new ignored tests conceal failures.
• No secrets: no API keys, WorkOS secrets, R2/AWS credentials, keyring dumps, diagnostic journals, or real .env files are included. .env.example documents names only.

Risk

• Substantive server auth/API and filesystem-boundary changes require careful review. The server is not a mutually untrusted multi-tenant sandbox, and these tests do not establish complete TOCTOU protection.

• Diagnostics are opt-in, bounded, private, and local-only. CI uploads synthetic test/coverage/QA case reports, not diagnostic journals, aggregates, or server logs.

• The quality gate retains 178 inherited findings rather than pretending to eliminate existing debt. Dynamic feature consumers still need human review; no new feature flags were introduced.

• Release cadence, backlog health, non-Linux execution, live coding-service QA, full Dev Containers setup, CPU sampling, and a new persisted readiness score are not established by this PR.

• GitHub still reports the pre-existing medium Dependabot alert #2 on main (GHSA-w9wp-h8wv-79jx). This PR does not claim to resolve that alert.

See docs/guides/readiness-remediation.md for the verified pre-publication snapshot and explicit limitations.

GitHub CI result

CI run 34063315988 passed on ff0b9b461bbb3b3e9bf005fb6c347816e2e3a8a6. All 12 checks passed, including CodeQL and CI Success. Remote changed-line coverage is 750/879 (85.32%), with no absent production files.

Earlier runs exposed missing clean-runner prerequisites. Those failures were fixed and covered by regression tests; no gates, thresholds, or tests were disabled. No merge or release was performed.