feat(native): verify retained file grants and protected secret modes

[roodboi]

Retained file adoption has a closed version-8 owner for explicit file grants on the supported default-network family. It verifies original bind/source identity, effective guest UID/GID and permissions; only private snapshots may use 0444, 0400 or 0600. Current start/restart/exec and final publication recheck material and operation completion. Saved stop/recovery does not need current source material. Original files are never chmodded or rewritten, and public reports omit material values and digests.

The container observation now treats an omitted bind Mounts.Name as the exact empty string. Present malformed values remain preserved or strictly refused, and named-volume names remain exact. The production formatter is exercised by a pinned real Docker CLI against an isolated synthetic Unix HTTP fixture; it never forwards to an engine.

Current head: 7be8ad22f88468131d2ecb82e6ca3e8e0b113dec, normally reconciled with canonical fe06bfc14b86c4313015a533bfd2c15c95dc9a47. Completed-job 7, file 8, and canonical recovery owner families remain separate. All file publication callbacks retain the shared beforeCommit contract and final receipt/artifact fences.

Validation:

• Independent cumulative SOURCE review; scoped CLI typecheck, lint, staged privacy, diff and commitlint passed.
• Mount formatter/binding controls: 8 passed / 0 failed. The initial 4-pass/4-fail synthetic test-oracle result is preserved separately; null must retain exact null, while other malformed values may only remain exact or produce the probe owner's issued child refusal.
• Current shared-lock controls: 9 passed / 58 assertions. File-8 failed-effect/saved-stop interaction: 1 passed / 5 assertions. Every owned child and pipe settled.
• Earlier unchanged job final-source control passed alone with 16 assertions; its preceding combined 6-pass/1-fail deadline diagnostic remains preserved. Fresh exact-head CI is required; prior-head checks are historical evidence.

Actual protected guest access and retained two-worktree lifecycle remain pending. Four maintained M3 attempts stopped in prerequisites: Unix socket canonicalization, Darwin Git link metadata, omitted bind Name inspection, then unsupported synthetic retained-source fields. None reached protected material/application setup. Captured commands settled, and ROOT independently verified complete original engine inventories after each. No live permission acceptance, performance improvement or full NC04 completion is claimed.

The dependency fixture now pins the exact shipping presence-specific ownership and alias templates while retaining the separate config-hash observation and every read-only argument/resource gate. Current formatter/guard controls: 42 passed; the added runtime-format control passed with 4 assertions, and both affected preparation/lifecycle positives passed with 22 assertions. Earlier exact-head hosted failures and the initial draft 1-pass/2-fail result are preserved. A private fixed-fact capsule identified the draft’s removed runtime-format dependency; no product predicate, deadline or cleanup was widened. All children settled; fresh exact-head CI remains required.

[blacksmith-sh]

Found 1 test failure on Blacksmith runners:

Failure

Test	View Logs
native-compose-adoption-job-worktrees (22.0s) — Completed-job worktree acceptance refus ed; values omitted./ native-compose-adoption-job-worktrees (22.0s) — Completed-job worktree acceptance refus ed; values omitted.	View Logs

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[roodboi]

Closing as source consolidation into #227. The complete head and all 29 owning file blobs are preserved there. Historical failed checks remain recorded; protected retained-file guest permissions, lifecycle and recovery remain open in #227. New VM material transport #250 is a separate capability. Branch retained.