[ITSGJY]

Fork-only CI staging for commit b0924a1746654db6025fffd9e2ad2dbd435c656f, based on upstream 05d45f376d3265490de28090b9c5b0150dbacd8b.

Validates the yyjeqhc#599 F3-A slice:

• optional dependency_policy: {"mode":"locked"} on project_build and project_validate
• Rust project build/check/test map the policy to Cargo --locked
• Go project build/vet/test map it to -mod=readonly
• project_validate(action="format_check") rejects the policy
• requests without the policy preserve historical argv and validation identity
• locked validation uses a distinct durable target identity
• policy-bearing planning and typed Job admission require additive project_dependency_policy_v1
• direct cargo_* / go_test schemas and behavior remain unchanged
• offline/network policy remains a separate extension

Focused local suites passed 723/723. Independent Codex re-review found no actionable regressions. GitHub Actions run 36827792942 completed successfully on attempt 2 for the exact head SHA, including Linux workspace/Server/Runner, Windows core/Runner, macOS core, contract, MCP conformance, aggregate test, and native checks.

This PR is fork-only CI staging; it is not the upstream submission.