test(ci): enforce candidate validation before aggregate planning

[schlessera]

Refs #2400

What changed

The hosted aggregate validates the candidate before planning selections. A spawned draft/no-token regression executes the real aggregate with GITHUB_ACTIONS=true and requires the live-readiness refusal. Missing selection outputs make a removed or reordered candidate call fail immediately at the named assertion, without computing a whole-repository plan fixture. Both gates retain their existing acceptance rules.

Why this shape

This covers the executable-entry-point gap from #2363 while keeping the regression fast. The refreshed contribution preserves both independently audited producer binders, their frozen positives and source/installation drift refusals. Main's BRAIN_SELECTED_PROOF_RECEIPT and both MERGE_CONSUMER_RECEIVES_VALIDATED_SELECTED_INVENTORY assertions survive the merge. No qualification digest was repinned, production behavior changed or retention saving claimed.

Proof

Fresh local proof uses head 9180099d26bf5c6ee337fd37a4f0e23d60a322e7, base 3f6008994c032939cca43cdf991f3efd86e742ec, tree 534ff023d4459496130061042a522352fca24642. This clean candidate preserves original head cc98b95e81a2ab2a1444f0073b18d2d49b264827 through a normal history-preserving merge. Independent live main matched the recorded base before and after each allocated stage.

Fresh receipts, 2026-10-20:

• Failing first: temporarily restoring only the old gate order exits 1 at AGGREGATE_MUST_REQUIRE_LIVE_DRAFT_READINESS: expected Draft proof requires live read-only GitHub readiness verification, received Candidate selection cadence is missing or inconsistent. No module-load error or timeout substitutes for that assertion.
• Actual-call mutation: removing only the aggregate's await requireCandidate(...) call exits 1 at the same intended assertion. Both mutations were restored byte-for-byte. The restored named test passes 1 test / 3 assertions in 146 ms; the final restored focused suite also passes it.
• Restored focused suite: 54 tests / 52,168 assertions across eight actual files covering hosted/candidate admission, native source qualification, generated build/CSS/theme inputs and inclusion. The originally supplied ninth filename does not exist; no ninth-file execution is claimed.
• Strict root types: bun run typecheck passes.
• Required actual preflight: bun run check:pr --base origin/main passes once: all metadata/contribution gates, 970 fast tests / 6,438 assertions, then 73 import-graph feedback tests / 6,323 assertions. These batches may overlap. Total command wall time is 184.29 s. git diff --check passes.

These receipts use Bun 1.4.2+744846f84, a fresh private-cache frozen copyfile install matching qualified installation identity 0c2758c046f2b69d5f33b66521baf3098db5f44256b73ec96961c98d381e6245, ordinary UID, owned temporary storage, read workspace access and the unchanged offline preload/deadlines. Proof commands run with no external route and dropped capabilities. Source, lockfile and installed bytes remain unchanged after restoration. Receipt IDs retained for review: old_order_red, restored_green, removed_call_red, focused, strict_types, and default.

The single inspected plan and actual preflight selection agree: global, all 19 packages, 48 fast files, types and packaging selected, all hosted category flags true. The 1,130-file complete unit discovery is planned inventory, not executed proof. Complete selected hosted proof for this refreshed candidate remains pending; the PR stays draft.

Preserved failed confirmation

Run 39216998411, attempt 1 remains failed for old head cc98b95e81a2ab2a1444f0073b18d2d49b264827, base 90a95123cfceb169bd2ecf7c213544db742eaed7, actual merge checkout 7d202bc304fe14d2509ec8c14dcee30da65ca5b7, tree 2a641151375ba62ccce2b03d9b1e93fd060e664b. Browser (2) exceeded the unchanged 15-second module-settings dark/320 whole-case deadline; the aggregate correctly rejected the failed browser category. The other 15 jobs passed. Original raw local receipts and the original checkout were not recovered; historical local claims are not reconstructed or relabelled as fresh proof.

Since that run, #2442 delivered the module-settings purpose partition and overlay motion correction, and #2455 delivered destination-specific paint partitioning. These changed inputs support renewed qualification under the campaign ruling. They do not establish the historical cause, repair or waive #1229/#2441, or make this candidate's pending hosted proof green.

Checklist

• Complete selected hosted proof and actual current-candidate job checkout reconciliation passed; fresh local proof above passes.
• All issue acceptance and required verification are complete; remaining work is named below.
• PR and issue retain verified milestone 0.44.0.
• No consumer-visible package change; no changeset required.
• Repository leakage gate passes.
• No machine contract changed.
• No documented code citation moved.
• No provider-facing conversation path changed.

Anything left open

Complete selected hosted confirmation, current head/base/synthetic-checkout validation, matching-tree merge and actual-main qualification remain with the coordinator. This is a Refs #2400 slice until its full acceptance and verification criteria qualify. #2400 remains open with its canonical Blocked by #1229 declaration; the unresolved causal criteria in #1229/#2441 and all historical failed identities remain intact. Local passing receipts do not replace those obligations.