Add fail-closed diagnostic task inventory

[myobie]

Summary

• add st2 tasks --json with the versioned st2.task-inventory.v1 envelope
• join host-filtered desired PTY and exec tasks to exact or conservatively proven runtime generations
• fail closed on declaration drift, duplicate IDs, malformed or timed-out PTY evidence, PID reuse, unreadable state, and otherwise unprovable generations
• document the command as read-only diagnostics and automation, never reconciliation or control-plane cutover authority

Safety boundary

This branch is directly based on current main and has no PR #106 ancestry or dependency. It adds no catalog lock, publisher, incomplete-apply state, lifecycle flip, CAS protocol, or cutover procedure.

The existing exec writer remains a plain PID record. Spawn, list, kill, reap, remove, and all lifecycle behavior are unchanged. Inventory observes legacy PID state without rewriting it, verifies the live PID against its kernel start token and PID-file mtime, and reports indeterminate when that proof is unavailable. Missing PTY and exec roots remain absent.

Catalog discovery runs before and after runtime observation. Semantic drift makes the receipt incomplete; this detects observed change without claiming writer serialization or a transactional snapshot.

Verification

• 7 task-inventory model tests
• 4 conservative exec-generation observation tests
• 4 PTY observation unit tests
• 8 CLI/E2E tests, including real PTY generation replacement, catalog drift, timeout, malformed evidence, and byte-level immutability
• existing exec backend, Nomad survival, and Linux transport-isolation suites
• full cargo test --workspace --all-targets -- --test-threads=1
• scoped Clippy with warnings denied
• workspace doctests
• invariant proof-reference gate
• changed-source rustfmt checks and git diff --check

Hosted Nix and independent macOS verification are pending.