test: stop M9-A0 trusted boundary rerun

[shenjiecode]

Summary

• reruns M9-A0 against the revised design baseline 1c1534f;
• performs the required first source/type/contract layer;
• records that the Trusted boundaries are not yet implemented or exposed by pinned OpenClaw;
• stops before container fake-provider, deterministic integration, and Matrix layers.

Result

Layer 1: FAIL / stop.

Direct facts:

• pinned OpenClaw reaches the provider/session path at activeSession.prompt(effectivePrompt, ...);
• no TrustedModelCallBoundary or TrustedToolExecutionBoundary exists in the inspected pinned source;
• before_prompt_build still catches errors and continues;
• before_model_resolve has no block result field;
• native tool_result_persist remains synchronous-only and default fail-open;
• current Tiangong still registers native capture and local store.appendSync(record), without a proven wrapper around every tool executor;
• no native before_tool_call timeout enforcement exists.

Scope boundary

No runtime implementation, OpenClaw patch/upgrade, fake provider, Matrix fixture, or external test resource was started. A separate source-patch/integration decision is required before another rerun.

Verification

• git diff --check
• run-plan local-link check
• run-plan/evidence whitespace and tab check
• Docker source inspection with --network none
• no external resources created

Refs #114
Related: #110, #111, #112, #113