fix(reddog): harden governed Holo and Git context

[Foundup]

What changed

• hardens generation-bound HoloIndex Tier-0 retrieval and explicit module README/INTERFACE grounding
• extracts collection search/injection helpers and seals backend manifest/index proof
• hardens RedDog governed Git context against TOCTOU, path identity, ignored-content, hardlink/symlink/junction, batching, and cap failures
• updates RedDog/Holo documentation, audit evidence, contract shards, and focused tests
• isolates governed maintenance child output in JSON-only mode so verbose library output cannot displace the terminal machine receipt
• preserves only the terminal allowlisted maintenance receipt and adds opt-in bounded stage markers for process-level diagnostics

Why

The prior audit exposed two extension audit-grounding contract failures, noisy/stale module retrieval, and incomplete governed Git evidence boundaries. The changes generalize those failures into fail-closed contracts rather than patching fixtures.

The follow-up maintenance investigation initially appeared to fail during symbol reconciliation, but an independent Codex session had been terminating the PowerShell/Python maintenance child chains. Once those terminations stopped, the unchanged symbol indexer completed a full governed refresh. The retained changes improve bounded diagnostics; no speculative symbol mutation workaround remains.

Validation

• exact independently verified tree: 05c38de4a99dcda206aa9bba5bc637a7a42d8ea2
• original hardening commit: 8a77f05740e604685fa23af1ba9e6d24081ba506
• current PR head: 73e883cb97bdfe417f1101608eb95f5ff0d648d9
• independent WSP_97 disposition: PASS_TO_INTEGRATE
• focused closure: 259 passed, 1 skipped
• maintenance-output/handshake regressions: 19 passed
• direct Fusion WSP_62 companion: passed
• exhaustive RedDog extension contract: passed in 300.205s under the 420s release-gate ceiling
• uninterrupted governed Holo refresh: REFRESHED; all baseline stages and freshness proof completed
• governed semantic acceptance query: ok=true, freshness=CURRENT, index_gap_detected=false
• RedDog backend manifest: 1336 runtime files, digest 932c35752db3f99a84ca31ee3d90eb2508f8ccac0193ab67d208b8357364cb81
• WSP_15: 20/P0

Operational note

The persistent Holo store must be activated and accepted at the exact merged SHA through the governed maintenance/owner path. No raw query-time reindex is used.

[Foundup]

WSP_97 Post-Merge Truth & Integrity Attestation

• Final PR Head: \102bd7d7\
• Squash Merge Commit: \80328ac3d\
• Test Registry: \1519 total / 263 quarantined\ (\scripts/tests/test_generate_reddog_backend_manifest.py\ unquarantined and verified 5/5 passing)
• RedDog Backend Manifest: \1,337\ runtime files
• Canonical Manifest Digest: \05d91f3e9714c5c4ec6e58bbee62f6b7ee6d0cc49ad8cf104c09bdd29c8ec49\ (pinned in \extensions/reddog/backend_compatibility_constants.js\ and verified against staged index)
• CI Status: All 10 workflows passed (CodeQL, Lint, Security, Holo Freshness, Python 3.12, Red-team observation).