Harden live SOCKS CI with safe diagnostics and session isolation

[promisingcoder]

Summary

Investigate and harden real Meta SOCKS validation after main CI run
37451520501
failed four client-DNS SOCKS cases while HTTP and proxy-DNS SOCKS passed.

Changes

• Add allowlisted diagnostics from actual Meta responses: HTTP status, numeric GraphQL error codes, token presence only, and requested Meta destination addresses.
• Separate generated private residential sessions by test family while keeping related DNS variants matched; preserve explicitly configured user sessions.
• Add a blocking installed-wheel live-proxy CI stage for all six SOCKS checks; retain the same cases in the full live suite.
• Add privacy, instrumentation transparency, session matching, and workflow regression contracts.

Validation status

• Initial focused unit contracts and Ruff passed.
• Main baseline: 17 CI jobs passed; core live had 95 passed, four failed, two sample-dependent skips. MCP live was blocked by core live.
• Unchanged baseline local SOCKS reproduction: all six passed.
• Initial scoped local run: five passed; one real Meta bootstrap request timed out. This is under investigation; the PR remains draft until validation is complete.
• Core and MCP runtime sources are currently unchanged.

Review focus

Please review DNS semantics, preservation of genuine SOCKS5 IP destinations,
credential privacy, session consistency, failure propagation, and test validity.
Failures must remain blocking; replacing client-DNS cases with proxy-DNS cases
would remove required coverage.

Qodo review has been requested separately. No report or private proxy credential
is included in this branch.

[promisingcoder]

/review

Please focus on actual SOCKS5 versus SOCKS5h DNS semantics, generated residential
session isolation, preservation of explicit user sessions, credential privacy,
and whether the regression checks remain valid and blocking. Review this as a
CI reliability change built on the existing collector runtime.