build(cyborg): qualify the CAGE-2 runtime profile

[Brad-Edwards]

Summary

Qualify one immutable official CAGE-2/CybORG 2.1 source closure, record its exact runtime evidence and blockers, and keep the public simulator extra fail-closed because no governed patched artifact exists.

Requirement UIDs

• (none — bug/refactor/maintenance run; see Traceability section below)

Related Issues

Closes #12

ADR Impact

• ADR-069
• ADR-003

Changes

• Add backend-local source, dependency, packaging, legal, defect, and bounded smoke evidence for the selected CAGE-2 runtime profile.
• Add a packaging-only candidate patch and an executable qualification driver that rebuilds, clean-installs, and exercises the pinned closure.
• Run qualification through the canonical verification graph and document the RAES authority and native-data boundaries.

Test Plan

• Unit tests pass
• Integration tests pass if applicable
• Configured completion command passes
• No coverage regression

Canonical verification and policy gates pass on the synchronized tree; the standalone qualification driver reproduces the pinned source, wheel patch, dependency closure, and bounded smoke.

Ground Control Checks

• Configured repository policy command passes
• gc_evaluate_quality_gates passes or is unchanged by this repo-only change
• gc_run_sweep reviewed; findings fixed or recorded with rationale

Traceability

• IMPLEMENTS: Issue build(cyborg): qualify and pin the supported CAGE-2 runtime profile #12 ← src/raes_adapters/cyborg/qualification.json, Issue build(cyborg): qualify and pin the supported CAGE-2 runtime profile #12 ← tools/verify_cyborg_qualification.py
• TESTS: Issue build(cyborg): qualify and pin the supported CAGE-2 runtime profile #12 ← tests/test_cyborg_qualification.py, Issue build(cyborg): qualify and pin the supported CAGE-2 runtime profile #12 ← tests/test_cyborg_qualification_driver.py, Issue build(cyborg): qualify and pin the supported CAGE-2 runtime profile #12 ← tests/test_cyborg_smoke.py

Checklist

• Code follows project coding standards (docs/CODING_STANDARDS.md)
• No business logic in API layer
• Domain layer has no framework imports
• Envers @Audited on new entities if applicable
• Changelog: owned by Release Please (generated from the Conventional Commit PR title; no per-PR fragment)
• Architectural docs updated if stack, package structure, or key behaviors changed

Documentation

Updated: see diff.