Repair deterministic CLI and runtime contract drift

[chubes4]

Summary

• stop detach and stdin-plan raw argv scans at the passthrough delimiter while preserving forwarded tokens verbatim
• make explicit runner run IDs authoritative over request and extension-provider environment across local, reverse-worker, and direct-daemon transports
• preserve provider-provider collision rejection and carry redacted precedence diagnostics through daemon result projection without duplicates
• align stale Clap alias, command registration, resource policy, Ops JSON, and provider-budget fixtures with their registered current contracts
• retain the intended missing-provider deploy and release planning boundaries

Stack

This PR is stacked on #12001 because current main cannot compile the focused suite without its fixture repair and its POSIX sidecar fixture is part of the same observed shard corpus. The diff against this PR base contains only #11964 changes. Retarget to main after #12001 lands.

Verification

• fanout focused suite: 15 passed
• resource policy suite: 48 passed
• runner status suite: 20 passed
• raw argv guard, watch alias, CLI provenance, Ops JSON, deploy missing-provider, and release resolver focused tests passed
• direct-local, reverse-worker, and direct-daemon provider/run-ID precedence regressions passed
• provider-provider duplicate rejection passed
• canonical daemon idempotency-key test passed
• post-rebase a_new_raw_argv_flag_scan_is_a_failure and daemon_exec_injects_extension_env_and_redacts_provider_secret passed
• cargo fmt --all -- --check and git diff --check passed
• final iterative review found no unresolved correctness issues

Closes #11964.

AI Assistance

OpenAI gpt-5.6-sol via OpenCode isolated the deterministic shard contracts, implemented and iteratively reviewed the cross-transport repairs, and ran focused verification under human direction. Chris Huber remains responsible for every line.

[chubes4]

Superseded by #12012, which landed the deterministic CLI and runtime contract repair on main. AI assistance disclosure: OpenAI gpt-5.6-sol via OpenCode was used to verify patch equivalence and reconcile the PR queue.