[codex] Fix production readiness gates

[yaksetig]

Summary

• Update rustls-webpki in both lockfiles to clear the current cargo-deny advisory.
• Repair fuzz target drift after CounterSystem became a ThresholdAutomaton alias, and add a parser regression for the malformed temporal formula timeout artifact.
• Bound Lean/Coq smoke-test toolchain probes so unavailable or wedged tools skip/fail quickly instead of hanging CI.
• Stabilize ByMC Docker setup by installing a pinned opam binary instead of streaming the mutable installer script.
• Improve CometBFT live-adapter readiness checks and preserve Docker triage artifacts before stopping live harnesses.

Root Cause

The failing gates were split across dependency policy, fuzz API drift, parser ambiguity under malformed input, mutable external installer behavior, and a live-adapter workflow that cleaned up containers before failure evidence could be captured.

Validation

• CMAKE_POLICY_VERSION_MINIMUM=3.5 cargo test --all-targets
• CMAKE_POLICY_VERSION_MINIMUM=3.5 cargo clippy --all-targets -- -D warnings
• cargo fmt --check
• cargo deny check
• cargo check --manifest-path fuzz/Cargo.toml
• bash -n scripts/cometbft-live-harness.sh scripts/cometbft-conformance-active-smoke.sh benchmarks/bymc/build-docker.sh
• .github/workflows/live-adapter-conformance.yml parsed with PyYAML
• python3 scripts/check_generated_artifact_drift.py
• python3 scripts/check_public_api_doc_coverage.py --min-pct 80
• python3 scripts/validate_final_completion.py --strict-evidence
• python3 .github/scripts/check_doc_consistency.py
• python3 .github/scripts/check_release_doc_sync.py
• python3 .github/scripts/check_release_doc_refs.py
• python3 .github/scripts/check_workspace_package_metadata.py
• ./scripts/check-engine-no-panic.sh

Notes

Docker is not running in the local workspace, so ByMC Docker build and live-adapter Docker smoke coverage need GitHub Actions validation before a production release.