fix: preserve Sonar remediation contracts

[aksOps]

What changed

• restore deterministic UTF-16 code-unit ordering for durable outbox traversal
• add mutation-sensitive records, drain, and reconcile ordering regressions
• replace the vacuous IdentityGate cleanup assertion with an observable StrictMode race test
• add injection-shaped SQL scope/link/key characterization, including adverse cross-scope row ordering

Why

Independent review found that the previous localeCompare change altered durable ordering and that two remediation tests could pass without proving their intended contracts. This corrects those gaps before G004 is checkpointed.

Validation

• npm test: 64 files, 905 tests; 98.24% statements, 95.21% branches, 98.72% functions, 99.43% lines
• npm run build: passed
• go test ./...: 897 tests passed
• go test -race ./...: 897 tests passed
• go vet ./...: passed
• Go formatting and diff checks: passed
• all five commits have valid ED25519 signatures
• independent code review: APPROVE

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud