Certify the adversarial implementation workflow end to end

[taras]

Story

As a release owner, I want an adversarial cross-runtime certification matrix, so completion of #181 is demonstrated under interruption, replay, stale state, and failure rather than inferred from happy paths.

Acceptance matrix

• Process exit and partial replay against the same retained Workspace root.
• Completed replay with zero Workspace, Agent, Worker, or external-provider attachment.
• Restart while suspended for exact correlated user input.
• Cancellation during Agent, filesystem, local Git, Worker Shell, forge, and user-input operations.
• Atomic publication or rollback of local mutations and filtered journal results.
• Missing/corrupt authoritative Workspace failure without false restoration.
• Multi-repository and named-Worktree retention, including dirty and unpushed state.
• Stale base, moved remote branch, changed pull-request head, and ambiguous external completion.
• Mandatory read-only Agent authority and constrained generated-XMD preflight.
• Malformed Agent output and exhausted correction or implementation attempts.
• Duplicate-effect prevention, history inspection, compatible fork, and incompatible-fork rejection.
• Secret rejection before journal persistence without scanning arbitrary Workspace contents.
• Deno, Node, Bun, compiled binary, TypeScript, and JSR gates.
• No required state exists only in an Agent transcript, host path, provider handle, or Git sidecar ref.
• The final documents use only architecture.md terminology and describe shipped behavior.

Exit

Every required issue in #218's implementation map is closed, every end-goal capability in #181 is complete, and the living workflow matches production behavior. xmd play, a public remote-host selector, Worker JavaScript, native subprocesses, and writable FUSE remain separate later layers.

Dependencies

• Resume workflow runs from explicit durable signals #300
• Every other required story listed by Implement retained Workflow Workspace restoration #218
• End goal: Document adversarial implementation workflow WIP #181.