fix(track-a): bind canonical Xvfb to contained DRI provider

[blakinio]

Track A hosted-only canonical Xvfb DRI-path repair

Task: OTC-20260816-track-a-canonical-xvfb-dri-path-fix.
Base: exact trusted main@d3f186414256151c9d5e03f34c5a9026b1fba500.
Execution: GitHub-hosted only, runtime_access:none; no Synology/runtime E2E in this PR.

Physical research Drafts #415–#421 narrowed the missing-window graphics prerequisite to one exact provider path. Most importantly, #421 proved the current canonical Xvfb argument surface exposes GLX without any new server flag when only the contained DRI search path is supplied: extension count 22→23 and GLX=false→true, opcode 150.

This repair therefore stays minimal:

• adds a fail-closed contained_dri_root() contract derived only from the selected trusted toolroot;
• requires a real contained usr/lib/x86_64-linux-gnu/dri directory;
• requires swrast_dri.so to exist and resolve to a regular file below that DRI directory/toolroot;
• makes toolroot admission reject missing/escaping DRI providers;
• exports only LIBGL_DRIVERS_PATH="$dri" into the canonical Xvfb launch environment;
• preserves the existing Xvfb argument list exactly — no +extension GLX;
• leaves the official client graphics environment unchanged;
• adds resolver escape/missing-provider regression tests and source-contract tests for the Xvfb-only environment change.

No lease, transition, registration, Gate B, WARP, credential, client backend, Track B or runtime ownership contract is weakened. No owner-funded Codex/OpenAI API quota is used.

This remains Draft-only pending exact-head hosted validation and coordinator promotion.

[blakinio]

Coordinator disposition: ACCEPT / CLOSED_SUPERSEDED_BY_429. The DRI-path repair was independently audited against promoted causal proof #427/#428. Dedicated hosted validator 31966128631 / job 95211462614 passed session 14/14, transition 9/9, guard 3/3, lease 14/14 and source contracts. Source final governance 31966417003=SUCCESS, CI 31966417334=SUCCESS, CI / Required 95212359032=SUCCESS, zero review threads. Current main source/test blobs were verified unchanged from #423's merge base, so the exact audited worker/test/evidence blobs were replayed cleanly into current-main promotion PR #429. This source Draft is closed unmerged to avoid stale history. No physical runtime execution occurred.