Harden loop engineering orchestration

[arbazkhan971]

What changed

• hardens orchestration state, durable ledgers, routing, provider transport, streaming, worktree settlement, and restart/resume behavior
• adds fail-closed OS containment and a durable pre-execution launch handshake
• introduces safe tmux naming/client/workflow handling, dashboard hardening, configuration validation, diagnostics, and an easier starter experience
• expands documentation and examples for the complete loop-engineering workflow
• adds deterministic unit, integration, adversarial, mutation, and end-to-end coverage

Why

The previous implementation had correctness gaps around crash recovery, process-tree containment, provider failure classification, concurrent ledger publication, streaming bounds, worktree races, and tmux lifecycle management. Several failures could leave ambiguous state or report success without sufficiently durable evidence.

This change makes unsafe or unverifiable execution fail closed and ensures every completed run is backed by durable, replayable evidence.

User impact

Projects get a safer default workflow, clearer configuration and diagnostics, controlled Claude-to-GPT fallback, resumable execution, bounded resource usage, and predictable tmux/dashboard behavior.

Validation

• npm run validate: 55 test files, 682 tests passed; typecheck and build passed
• npm run smoke: passed, including honest fail-closed behavior when OS containment is unavailable
• npm pack --dry-run: 141 entries; no src/, tests/, .workflow/, or scripts/ paths leaked into the package
• full-suite temp-directory delta: 0
• full-suite tmux-session delta: 0
• surviving cgroup and ledger lock-holder processes: 0
• focused mutation tests verified journal failure prevents provider execution