Validation executor: hardened shared reports and eligibility

[zkwentz]

What & Why

Validation plans need deterministic execution that preserves failure evidence without letting one check corrupt the report. This PR adds the hardened executor and separates passing, eligibility, and certification state.

Risk & Review Guidance

• Risk level: HIGH — executor and report semantics are security- and policy-sensitive
• Task class: security
• Review focus: src/openenv/validation/executor.py:233 for execution/failure handling; src/openenv/validation/models.py:597 for aggregate report semantics
• Blast radius: Incorrect exception, timeout, or aggregation behavior could turn a missing/failed blocking check into an apparent pass.

Decisions & Alternatives

• Catch failures per criterion — one check error is recorded rather than aborting the report.
• Certification is not executor-owned — the executor can produce eligibility evidence but never a signed certified result.
• Bound and redact evidence — rejected embedding raw exceptions or arbitrary submitted objects.

Verification

• PASS: PYTHONPATH=src:envs .venv/bin/python -m pytest tests/ -q -m 'not integration' — 1,559 passed, 114 skipped, 31 external integration tests deselected on the complete stack.
• PASS: Fork whole-stack CI — 7/7 checks passed, including Python 3.11/3.12, lint, docs, lock validation, and package smoke tests.
• NOT verified: No signed report registry exists yet.

Scope & Non-Goals

• No process isolation is provided by this executor; isolation belongs to the selected runner.

Stack

PR 4 of 17; depends on #944.

Full 17-PR stack

1. #942 RFC 008: Spec-neutral local and remote validation architecture
2. #943 Validation foundation: spec-neutral contracts and adapters
3. #944 Validation policy: spec-aware check registry and planner
4. #945 Validation executor: hardened shared reports and eligibility ← current
5. #946 Local validation API: execution-model-aware profiles
6. #947 CLI: validation profiles and shared reports
7. #948 HF runtime: dedicated sandbox execution mode
8. #949 HF certification: enforce trusted dedicated isolation
9. #950 [RFC 008] Define remote author validation and publish gating
10. #951 Validation: unify CLI reports and add a strict publish profile
11. #952 Validation: add structured author diagnostics and remediation
12. #953 Validation: run author validation in dedicated HF Sandboxes
13. #954 Validation: isolate submitted code in author Sandboxes
14. #955 Validation: bind author reports to policy and source
15. #956 CLI: scaffold publish requirements
16. #957 CLI: gate pushes on staged remote validation
17. #958 Docs: explain local, remote, and publish validation

All upstream PRs remain draft while RFC 008 is under review.