Harden Runtime Grid evidence and OSS boundary

[ashishki]

Outcome

Aligns Agent Runtime Grid with its executable local CLI/library surface and makes run evidence machine-readable and tamper-evident.

Changes

• persists rejected terminal-finalization attempts separately from duplicate terminal-event invariant violations
• emits atomic Markdown/JSON evidence bundles with SHA-256 manifests and a strict verifier
• requires an explicit local-only database reset flag
• removes placeholder API/worker and unconnected dashboard services from default Compose
• pins PostgreSQL 16.14 and BSD-licensed Redis 7.2.14 by multi-arch digest
• adds Apache-2.0 licensing, dependency review, contributor/security templates, and truth-aligned docs

Verification

• ruff format --check src tests: pass
• ruff check src tests: pass
• pytest tests -q: 97 passed, one upstream Starlette warning
• real 20-job stub smoke: 20 completed, 100% artifact integrity, zero duplicate terminal events, zero model cost
• evidence manifest verification and absolute-path/secret-marker scan: pass
• wheel build/inspection: LICENSE, console entrypoint, and SQL migration included

The committed verification record is docs/evidence/RUNTIME_OSS_TRUTH_REPAIR_2026-07-13.md. No hosted, production, external-user, or throughput claim is made.