policy: make managed containment structural

[sumitake]

Summary

• Seal opencode/build as output-only to the caller while preserving tool-capable work in a private temporary workspace.
• Document provider-agnostic structural containment: canonical user HOME for auth, read-only caller checkout, explicit provider-state writes, disabled in-request updates, bounded teardown, and verified cleanup.
• Reserve containment_error for pre-launch boundary failure or positive escape/protected-state evidence; keep auth, protocol/output, timeout, provider, teardown, and cleanup orthogonal.
• Bump the unreleased public package to 4.5.1, retain the full 47-skill generated surface including the recent domain-expert additions, and add a changelog fragment.

Boundary declaration

• No provider executor source, raw provider command, credential, private absolute path, retired package tree, downloader, or post-install hook is included.
• Native-runtime changes contain public policy only; implementation and credentials remain private.
• The change does not create a host-specific preset or provider-specific plugin.

Generated and release surfaces

• Skill specs and generated SKILL.md files are in parity.
• Claude and Codex marketplaces/manifests are in parity.
• A unique changelog.d/ fragment is present; generated CHANGELOG.md is unchanged.
• Version metadata is bumped to 4.5.1.

Verification

• python3 scripts/build_skills.py --check
• python3 scripts/build_marketplace.py --check
• python3 scripts/build-changelog.py --dry-run
• python3 -m unittest discover -s tests -t . -v — 579 passed
• python3 -m unittest discover -s scripts -p test_*.py -v — 254 passed
• python3 scripts/check_release_consistency.py --against-ref current/main
• python3 scripts/secret_scan.py
• python3 scripts/check-public-export-safety.py --active-tree
• git diff --check

The all-ref --history audit still reports the same legacy pre-unification provider recipes and credential-variable literals reachable on repository history. The active tree is clean; this PR adds no such material and does not mask the historical baseline.

Review and post-condition

Tier 3 because the change narrows a route authority and defines containment semantics. Exact-head independent-family review is pending. After merge, the private runtime companion will rebase to this public anchor, build a new continuity-safe candidate, and prove serial installed Gemini governance, Grok governance, and OpenCode plan calls before old-lane retirement.

Compliance trace

author: openai/codex gpt-5.6-sol
standing_directives: public AGENTS.md boundaries, generated-source parity, Tier-3 review, signed commit, and full deterministic validation followed
tier: 3
cross_check: PROCEED — managed Gemini governance exact head 5c783db, artifact f1218a1266bc47288d8584005bb85cf17aef38bd37bfa539d5511f90e3356986, proof 3075db81fe119f1c86adad7e0fbb80262ea6cdaf1013785223e880979fb76ebd
post_condition: merge before private candidate build; prove serial installed Gemini governance, Grok governance, and OpenCode plan with retained-lane rollback continuity
mcp_coverage_gap: NONE
contributor_rights: OWNER-AUTHORED
operator_reserved: no

[sumitake]

Exact-head managed governance review completed through the installed coordinator (no raw provider, relay, or inbox fallback).

• Reviewed head: 5c783dbf217695af16feb0a6fa2c63fb5154a01a
• Request: plugin64-structural-containment-gemini-governance-2
• Reviewer: google/gemini-3.1-pro / Google family / high effort
• Artifact: 56,104 bytes, SHA-256 f1218a1266bc47288d8584005bb85cf17aef38bd37bfa539d5511f90e3356986
• Broker proof: 3075db81fe119f1c86adad7e0fbb80262ea6cdaf1013785223e880979fb76ebd
• Runtime: agent-collab-provider-runtime/2.0.0
• Transport: broker; cleanup_confirmed=true; failed_over=false
• Final operative verdict: APPROVE / PROCEED
• Unresolved findings: none

The first review challenged broad canonical-HOME read exposure. The final head integrates that concern by explicitly documenting same-UID read trust and stating that canonical HOME is not a deny-all-read confidentiality boundary. The reviewer confirmed the revised boundary is truthful: caller checkout read-only, private writable request workspace, explicit provider-state writes, output-only OpenCode build, bounded teardown/cleanup, rare structural containment failure, and orthogonal auth/protocol/output/timeout/provider/teardown/cleanup results.