Phase L: make managed runtime startup deterministic

[datzle123]

Summary

• separate managed-runtime startup health from the browser render budget with a bounded 30-second CLI/MCP default and explicit override
• emit redacted timeout diagnostics with runtime state, PID and restart counters, then stop the process tree before returning
• replace the fixed MCP smoke port with a dynamic port and add an intentionally delayed broken/control flow that proves timeout cleanup and healthy startup
• refresh all five fingerprint-bound real-project cases, PostgreSQL CRUD cleanup, Level 7 role evidence and the Codex RD901 regression/repair cycle

Evidence

Fingerprint: 3663ff0c5e291f6a54b335d5d33fb9035e4e4495785dd15d2f1923e97b4e9d74

• pnpm check — 144 passed, 2 service-dependent skips
• pnpm audit --audit-level high — passed
• pnpm smoke — passed, including delayed MCP timeout/cleanup broken case and healthy control
• pnpm pack — passed
• installed-tarball smoke — passed
• external evidence validator — 5/5 cases and 9/9 capability classes
• artifact secret scan — passed
• PostgreSQL cleanup — 5 qualification rows removed, zero residual canaries

Hosted cross-platform and signed aggregate qualification remain required before Phase L is complete.