[ITSGJY]

Summary

• make existing Cargo/Go validation adapters own one canonical read-only execution plan
• derive the legacy synchronous command projection and structured Job argv from the same typed plan
• remove the duplicate Runtime-side validation argv builder while retaining Runner-side canonical-step validation as an independent trust-boundary check
• keep cargo_fmt mutation outside read-only planning and preserve existing tool schemas, authorization, Job handoff, validation evidence, and source-fence behavior

Validation

• cargo check --locked -p webcodex-validation
• cargo check --locked -p webcodex
• cargo test --locked -p webcodex-validation --lib — 100 passed
• structured Cargo/Go plan parity coverage — 6 passed
• validation handoff coverage — 35 passed
• Runner canonical validation-step coverage — 10 passed
• cargo fmt --all -- --check
• git diff --check
• deterministic committed-range review: 8 files fully inspected, no warnings or truncation

Validation PR for a bounded preparatory slice of upstream issue yyjeqhc/webcodex#599.

[ITSGJY]

Validation completed successfully on commit 65d86ce. Upstream review continues in yyjeqhc#684.