fix: integrate reviewed runtime and application repairs

[ScriptedAlchemy]

Hooks now retain each admitted edit and its native lifecycle across cold startup, replay, and retries. Source currency observes admitted edits before indexing settles; graph deadlines cancel their workers; failed project setup joins its owned resources; settings saves use generated PATCH contracts and report committed state truthfully.

This branch integrates the reviewed feature heads and their shared runtime repairs. Use a merge commit to retain the source PR ancestry. Release PR #4132 remains separate and follows this integration.

Included work:

• simplify(release): retire unpublished-crate distribution #4266 and build(evals): run evals on the shipping Bazel binary #4323 retire unpublished-crate distribution and run evals through the shipped Bazel binary.
• fix(dashboard): generate settings PATCH contracts #4275 generates settings contracts and reconciles committed settings with runtime activation.
• refactor(global-db): run more registered writes as job transactions #4321 moves registered writes into the existing job transaction authority.
• fix: remove the worldwide token counter #4322 removes the worldwide token counter and its configuration, CLI, and dashboard surfaces.
• fix(projection): settle Codex passes after session project_path collisions #4326 preserves canonical per-message project identity during Codex collision recovery.
• test(session-runtime): cut refresh groups without a wall-clock deadline #4325 removes wall-clock dependence from refresh-group tests.
• fix(mcp): preserve live graph request cancellation #4333 preserves graph cancellation and deadline settlement.
• test(dashboard): bound Bazel workers and isolate auth streams #4334 matches dashboard workers to the remote CPU allocation and isolates authentication-stream tests.
• fix(hooks): preserve durable hook admission and lifecycle replay #4335 provides durable hook admission, exact linked-worktree routing, event-specific lifecycle evidence, immutable replay order, truthful supersession, and current-configuration hint claims.
• fix(memory): separate process and shared cgroup admission #4336 separates process memory admission from shared cgroup headroom.
• fix(privacy): preserve UUID directory paths in entropy scans #4337 preserves UUID directory identity while detecting entropy tokens on bounded original path slices.

The integration also preserves glibc 2.31 allocator support, canonical temporal writers, joined retained-history setup, and refresh-worker retirement. Opaque project selectors include linked worktrees; path selectors retain exact per-message directory semantics. Immutable graph/text owners remain readable when source-admission evidence is unavailable, with currency withheld.

Claim rechecks now read the validated durable configuration snapshot without rebuilding indexing settings. Measurement identified about 1 ms of redundant materialization per recheck, performed twice on a live Stop. Full snapshot validation and stale-pin rejection remain intact, including malformed entries inserted under an unchanged revision. Privacy checks preserve dated UUID paths without treating UUID identity as credential entropy.

Anonymous sparse path pairs use the standard Base64 character alphabet before applying the existing overall token length and entropy checks. Per-fragment width and information cutoffs are removed: minimum-width tokens redact at every internal slash position. Filename punctuation no longer lets ordinary build labels and language/source directories supply token evidence. Existing named-credential rules and independently qualifying components retain their behavior.

An incompatible host spool keeps independent Core/read composition available, source currency fails closed, and host capability acquisition retains the original typed reset refusal without modifying persisted bytes. Recovery updates the same canonical broker slot.

Integrated workspace baseline on 9fae04507e:

• Normal full workspace run: all 164 test targets passed. This includes 938 root tests, 673 MCP tests, 79 daemon tests, 199 transcript-ingestion tests, 28 transport tests, 42 hosted hook journeys, and 140 privacy tests.
• All four changed-crate formatter checks passed. Clippy passed all 14 targets, including all three root library variants and affected test binaries.
• The complete commit range passes commitlint.
• Canonical dashboard/SDK generation, contract checking, and dashboard typechecking passed after feature integration; generated outputs remain byte-identical.

Follow-up verification on 4346e7a20e:

• Both failure modes were reproduced before treatment: ordinary directory pairs were redacted, and a 17/18-byte split escaped the per-fragment cutoff.
• All 142 privacy tests and crate formatting passed. Coverage includes two different minimum-width payloads at every internal slash position, exact metadata redaction, UUID separation, compact secrets, and byte-exact build/language/documentation/generated-source paths.
• Privacy library and unit-test Clippy passed. The complete current commit range passes commitlint.

The normal run uses the repository's standard budgets and concurrency settings. No investigative tracing is retained. Current-head hosted CI must pass before merge.

The saturated broker-reader cost remains explicit: 4,096 records / 14.8 MB took about 69 ms per borrowed read. Synchronous currency probes abstain on contention; the dashboard's existing blocking worker waits under the caller's original readiness deadline.