test(s2-step10): R7 full public-CLI Tier B + R8 CI wiring

R7: rewrite the Tier-B test to exercise ONLY the public pipeline, never
classify_delta / run_core / a private helper as its proof:

  real extractor -> candidates -> validate-plan -> apply (Owen rewriter) -> gate
  -> `own-fix subscriptions verify-delta` CLI -> published delta-result.json

using the copied extractor deployment, the amended runtime resolver, real Roslyn
extraction, and the real fresh snapshotted Python core. Cases: all-convert,
manual-only, mixed (each exit 0 + full published-schema validation, including
requested/selected runtime versions); deterministic byte-identical evidence
across two independent invocations; an OWN014 candidate -> ANALYSIS_SCOPE; and
forged-but-gate-valid bundles whose postimage introduces a new leak
(-> NEW_OWN001) or an unresolved subscription (-> NEW_OWN050).

Gating (R7): REQUIRED when OWN_TIERB_REQUIRED=1 — set in the wpf-extractor CI job,
where a missing dotnet / extractor / execution failure is a FAILURE, not a skip.
Any other context (the Tier-A tests job, the pack job, a local no-dotnet run) is
the explicit non-required mode and skips cleanly, so the offline suite stays
green.

R8: the wpf-extractor CI step now runs the required Tier-B; combined with the
lint / mypy / symlink fixes in the previous commit, the CI matrix is green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JxKjqdGEFzq4UzZupw379G

Author: PhysShell

.github/workflows/ci.yml

@@ -256,7 +256,9 @@ jobs:
             frontend/roslyn/samples/OwnedCollectionElementSample.cs \
             -o "$RUNNER_TEMP/facts.json"
           cat "$RUNNER_TEMP/facts.json"
-      - name: S2 step 10 analyzer-delta verifier (Tier B, real extractor + core)
+      - name: S2 step 10 analyzer-delta verifier (Tier B, full public CLI)
+        env:
+          OWN_TIERB_REQUIRED: "1"
         run: python tests/test_verify_delta_tierb.py
       - name: Check facts through the core
         run: |