chore(deep-clean): recover orphaned hardenings + dedup bench gates + de-dup steer-firewall

[drewstone]

Deep-clean sweep across the debt the self-audit surfaced. Behavior-preserving — no runtime semantics change; full gate green (lint + typecheck + 676 tests + build + bench tsc). Net −180 LOC of duplication/dead-code, plus two lost hardenings recovered.

Done as three file-disjoint tracks (parallel worktrees, each self-verified) then integrated + gated together.

P0 — recover orphaned hardenings (3d7fdff)

Two sandbox hardenings were lost when PR #183 squash-merged only its CLAUDE.md commit, stranding the later pushes. Recovered onto current main, reconciled with #185's cold-start recovery (additive, no overlap):

• read-retry: openSandboxRun's artifact read now does a bounded 4-attempt, abort-aware retry (injectable readRetryDelayMs, default 1000) — a transient Resource not found no longer becomes a permanent fake-empty patch (the bug that gutted the commit0 Layer-1 runs, 14/24 reads 404'd).
• provision-retry: acquireSandbox.isRetryable now treats create-thrown Edge data plane not reachable / Provision failed / Failed to create / Too Many Requests as retryable (retry onto a fresh host). The terminal is failed fast-fail invariant is preserved (its test still passes).

P1 — dedup the bench gate zoo (cb47904)

• New bench/src/stats.mts single-sources runPool + pairedLift + makeRng (were copy-pasted across 5 gates).
• corpus.ts gains buildRunRecordFromAttempts (5 gates hand-assembled the RunRecord literal); each gate's exact recorded values preserved via overrides.
• commit0-gate worker provider is now WORKER_PROVIDER ?? 'openai-compat' (was hardcoded openai, which rejected cheap router models).

P2 — runtime semantic debt (5f67497)

• The verbatim-duplicated steer-firewall (assertTraceDerivedFindings) collapses to one canonical site (cycle-checked: dynamic.ts now imports the personify/analyst.ts impl, private copy deleted).
• Removed the provably-dead createAnalystDriverHook (0 non-test callers, grep-verified).
• Documented the canonical atom in the barrel (Scope/Supervisor + combinators vs the round-synchronous runLoop+dynamic) — no exports changed.

Deliberately out of scope (own PRs)

Routing the gates through runExperiment (kernel) and demoting one of the three atom-substrates — behavior-changing redesigns, not a hygiene pass.