Harden Operator contract diagnostics and fixtures

[tgarciai]

Summary

• Add domain-owned Operator action contract diagnostics with explicit phases: action_shape, tool_arguments, and tool_bounds.
• Propagate contract phases through policy evaluation, contract coverage, MCP replay, benchmark adapters, and synthetic trajectory summaries.
• Move conformance payloads into strict fixture DTOs mapped through synthetic infra into domain value objects.
• Make MemoryArena and LongMemEval adapters fail fast on unbounded tool calls instead of burying them as generic target_action_contract failures.
• Stabilize the TLS full-journey fixture by waiting for the complete projected graph before running assertions.

Verification

• pre-commit hook passed: cargo clippy --workspace --all-targets --locked -- -D warnings
• pre-commit hook passed: workspace coverage for kernel and Operator, 84.80% line coverage, minimum 80%
• cargo test -p rehydration-tests-kernel --features container-tests --test kernel_full_journey_tls_integration --locked -- --test-threads=1
• synthetic smoke: read-api-mcp-v1 generated 716 trajectories with 0 contract validation failures

Notes

• The branch still keeps Operator independent from kernel implementation crates.
• Benchmark adapters remain external adapters; they do not define Operator language.

[sonarqubecloud]

Quality Gate failed

Failed conditions
10.1% Duplication on New Code (required ≤ 3%)

See analysis details on SonarQube Cloud