0.1.8 Beta1 E2E: make the supervisor start gate unique and fail closed #309

Parent

#258 (under #248)

Promotion-review evidence

The exact Beta1 promotion review of origin/dev at c245ee90bf189dfb77c9a3b9767ceebf06d2ccf5 found a fail-open race in scripts/Run-RealClientE2E.ps1:

• Every run uses the fixed runner-start-gate path.
• Removal of a stale gate suppresses errors.
• The worker proceeds when that path exists.
• Job Object assignment happens later.

If a stale or concurrently owned gate cannot be removed, the worker can observe it and start child processes before the supervisor has assigned containment. This weakens the process-tree cleanup evidence required for Beta1 release.

Design

• Give every supervisor run an unguessable/unique start-gate path and pass that exact path to its worker.
• Before worker creation, prove that the selected gate does not already exist; any preparation or cleanup contradiction fails closed with a bounded sanitized error.
• Assign the worker to the Job Object before publishing the unique gate.
• Make gate publication and cleanup explicit; a stale fixed gate from an older run must never authorize a new worker.
• Preserve existing watchdog bounds, artifact schema, client invocation, and product/runtime behavior.
• Do not weaken cleanup assertions, extend timeouts, add retries, or hide failures.

Acceptance criteria

• Two concurrent or sequential runs cannot share a start gate.
• A locked/stale legacy gate cannot release a new worker.
• No client child may start before successful Job Object assignment and publication of that run's exact gate.
• Gate preparation/publication/cleanup failures are bounded, sanitized, and fail closed.
• Synthetic tests cover stale/locked and unique-gate behavior without launching a real client.
• Existing RealClient E2E contract tests and partition checks pass.
• Exact-SHA Spec/Standards review has no P0/P1/P2.
• Only after review, Hosted CI / gate passes without rerunning a failed job.

Verification-Class: strict