test: ComponentLeadAgent failure tests; feat: wire NATSListener into daemon

[mvillmow]

Summary

• ComponentLeadAgent needs failure-handling tests (mirrors #87 ModuleLead) #183: Adds 4 DAG-deadlock-prevention failure-handling tests to tests/unit/test_component_lead_agent.cpp that mirror the ModuleLeadAgent tests from issue Handle task.failed events to prevent DAG deadlocks #87. Tests cover: single module TASK_FAILED → ERROR state, synthesizeComponentResult() returns error string after failure, failure before all results does not deadlock, and success-after-failure still counts toward completion.
• Wire NATSListener into the main daemon startup path #180: Wires NATSListener into src/daemon/main.cpp. The daemon now connects to NATS via NatsConnection, obtains a jsCtx*, constructs NATSListenerConfig from environment variables (KEYSTONE_NATS_URL, KEYSTONE_NATS_SUBJECT, KEYSTONE_NATS_DURABLE), calls NATSListener::start(js) during startup, and calls listener.stop() + nats_conn.disconnect() in the shutdown path. If NATS is unavailable the daemon continues running (health endpoint stays up) with a logged warning.

Notes

• CMakeLists.txt was not modified (owned by M2 wave). The keystone_nats and keystone_transport targets are assumed to already be linked into the daemon binary by the existing CMake setup.
• No TSan test variants added (blocked by concurrentqueue TSan issue).

Test plan

• just format-check — passes
• Build debug preset and verify no compilation errors in src/daemon/main.cpp
• Run ctest --preset debug --output-on-failure -R ComponentLeadAgent — all 16 tests pass
• Verify new failure tests: SingleModuleFailureTransitionsToError, SynthesizeAfterModuleFailureReturnsErrorMessage, ModuleFailureBeforeAllResultsDoesNotDeadlock, SuccessResultAfterModuleFailureStillCountsTowardCompletion

Closes #183
Closes #180

🤖 Generated with Claude Code

[github-actions]

✅ Dependency Audit

Severity	Count
Critical	0
High	0
Medium	0
Low	0

See the Security tab for detailed findings.

---

Workflow: Dependency Audit

[github-actions]

Security Scan Results

• ❌ Secret Scanning: Potential secrets found
• ✅ SAST: Completed (check Security tab for details)
• ✅ Dependency Scanning: Completed
• ✅ C++ Static Analysis: Completed
• ✅ Docker Image Scanning: 0 high, 22 medium vulnerabilities (acceptable)

Recommendations

• Review findings in the GitHub Security tab
• Check artifact uploads for detailed reports
• Address critical Docker vulnerabilities immediately

---

Workflow: Security Scanning