feat(track-a): implement canonical bootstrap rebind and Gate B

[blakinio]

SUPERSEDED by fresh-current-main replacement PR #371 (feat(track-a): repair canonical bootstrap transition).

Coordinator findings TACOORD-360-001..004 remain historical findings against this stale branch. Do not promote or execute this PR on Synology. PR #371 owns the remediation from current main and remains GitHub-hosted / runtime_access:none until independently validated and promoted.

Original scope was the canonical bootstrap/rebind/Gate-B implementation. This PR is closed unmerged to eliminate duplicate ownership and prevent stale code from becoming runtime authority.

[blakinio]

Coordinator independent audit on exact head 1d64fab66650b1fcd58388ff5cf6f9a77a392dc4: RETURN_FOR_EVIDENCE / CHANGES REQUIRED. Green governance/CI (31945024135, 31945024260) does not clear the following material findings.

TACOORD-360-001 — HIGH — rebind is not transactionally fail-closed after metadata commit. rebind() atomically writes the advanced registration, then performs the final _probe_registered_locked(). If that final probe/uniqueness/lease recheck raises, the command returns failure but leaves the advanced registration in place. This violates the task's cancellation/partial-failure acceptance. Required: rollback/restore the exact previous registration on every post-write failure (and verify restoration), or redesign so failed rebind cannot leave newly authoritative metadata. Add a deterministic regression test that forces final post-write probe failure and proves the old registration remains authoritative.

TACOORD-360-002 — HIGH — worker argv contract is currently unusable. Transition invokes [worker, "bootstrap", manifest] and [probe, "probe", manifest]; the shell worker receives $# == 2, but canonical-live-session.sh requires [[ $# == 3 ]] for both cases. Current physical bootstrap/probe would exit usage. Fix the command contract and add an executable integration test of transition -> real shell worker argument parsing (without physical runtime).

TACOORD-360-003 — HIGH — credential exposure through process argv. login_e2e() invokes xdotool type ... "$email" / "$password"; unsetting the environment does not prevent those secrets appearing in the child process command line and same-UID process inspection. The Track A credential boundary forbids exposing credentials/session secrets. Use a mechanism that does not place credentials in argv/logs (private pipe/stdin or equivalent bounded helper), and test the observable child argv/environment boundary with synthetic secrets.

TACOORD-360-004 — MATERIAL DEPENDENCY — bootstrap currently consumes an existing $BASE_STATE/runtime/wireproxy.pid/SOCKS 25354 service but the canonical task explicitly excludes PR #303-owned runtime surfaces, and current main has no searchable durable declaration for that PID/port ownership. Before physical use, prove this dependency is a current separately authorized non-PR303 service, or make bootstrap own/create its network helper inside the canonical process group. Do not inherit it from historical runtime state.

Until these are repaired and independently re-audited, #360 must stay Draft and must not be promoted to trusted main; consequently #358 remains blocked and no canonical physical mutation/login is authorized.