feat(r0): command effect contract and resource-scoped state sync

[Kucell]

M-041 — R0 Runtime Safety · Reconciled with latest main

Implementation is complete and the feature branch has been synchronized with current main@a99d70a (merged M-040 runtime/protocol/extension architecture).

Delivered

• Command Effect Contract v1 (none | read | mutation)
• exact changed resource/path receipts for Management writers
• resource-scoped State Sync (git add/commit -- <exact paths>)
• issue bug(cli): waitpoints --help triggers unintended state-sync push #15 hardening: unrelated dirty/staged state is never swept
• Inbox State Sync classification correction
• focused module/package regression coverage

Latest-main reconciliation — 2026-09-30

• branch head: 597d104a001655f4dc956269c8a1f8a8d9355343
• compared with main: ahead 21 / behind 0
• M-041 Runtime Safety run chore(m042): sync reconciled M-041 before revalidation #20 36701066878: SUCCESS
• M-040 Final Product Validation: SUCCESS
• M-040 Architecture Validation: SUCCESS
• M-040 Axrail Connected Project Pilot: SUCCESS
• PR remains mergeable: true

Existing Team Pack signal

The separate Team Pack workflow still has the known Node 14 compatibility debt around existing node:assert/strict usage. This is not introduced by M-041 and no Node support-policy change is included here.

Safety

• no main merge yet
• no release/publish
• no daemon/automatic dispatch change
• governance carrier: Kucell/cortex-agent-agent:mission/M-041-r0-runtime-safety

A separate merge authorization is still required.