feat(reddog): add guarded resident live canary harness

[Foundup]

What

Adds a guarded resident RedDog live-canary harness that can prove one real autonomous queue chain only when every persisted runtime boundary is causally and cryptographically consistent.

• shared same-process/interprocess queue-control lock across all main callers
• readiness-only and operator-confirmed execution modes
• atomic live-canary receipt with safe canonical/external path policy
• persisted control-loop receipt and exact final chain-revision witness validation
• real registered Git worktree/repository/HEAD validation
• canonical PatternMemory SQLite readback with recomputed record/admission identity and context lineage
• split focused/integration fixtures below WSP 62 communication limits

Why

The resident pipeline had many individually tested stages but no safe end-to-end proof that the same invocation advanced the same queue item through isolated worktree, verification, draft PR, outcome ratchet, PatternMemory, and stop. Earlier implementations were held after independent audits found concurrency, false-causality, fabricated-worktree, fabricated-PatternMemory, unsafe output-path, revision, and exact-transition gaps. This revision closes those blockers fail-closed.

Truth / safety boundary

• No live canary was executed by this change.
• No signer was started and no authority artifact was generated.
• No OpenRouter call, worktree, PR, PatternMemory production write, reward settlement, or HoloIndex reindex was performed during publication.
• Readiness is distinct from execution; execution requires explicit operator confirmation and the existing signed authority/runtime gates.
• This does not enable live Hermes delegation.

Verification

• independent final audit: P0 none, P1 none
• prior terminal-transition tamper probe now returns LIVE_PROOF_INCOMPLETE
• forged/digest-valid PatternMemory lineage probe now returns LIVE_PROOF_INCOMPLETE
• Windows focused: 24 passed, 1 skipped
• real integration fixture: 26 passed
• chain-store + PatternMemory sink: 16 passed
• broader focused matrices before final split: 122 passed/3 skipped, 66 passed/1 skipped, 14 passed/2 skipped
• Linux/WSL Ubuntu 24.04 focused suite: 67 passedn- py_compileandgit diff --check` clean
• WSP 62: production 632/560/121/127 lines; tests/support 351/314/200; added functions <=50

Merge gate

Focused Linux/WSL suite is green (67 passed). Keep draft until CI exits successfully. Merge does not authorize a live canary run.