Streamline CI preflight and focused verification

[cagdasyurekli]

What changed

CI previously repeated committed-range hygiene in every shard, and the contribution guide maintained a second expanded test inventory. Run hygiene once before the four existing shards, preserve their fail-closed aggregate, and list commands directly from the canonical registry. Add safe rejection context and selectable remediation groups for focused development.

The installed-package integration suite exercises the real CLI with a synthetic worker, checks candidate edits and scope rejection, and explicitly characterizes the existing outside-write gap. It does not fix or claim containment for that gap; product remediation follows this process-only change.

Verification

• CI diff checks: 23 passed; sharding: 103 passed; timing/listing: 46 passed.
• Installed workflow integration: 4 passed; package checks: 494 passed.
• Remediation runtime group passed; core/recovery routing, invalid group, and mismatched exact-label selection verified.
• Final stable-candidate offline suite: all 41 stages passed (exit 0). Required hosted CI remains pending.
• Independent review: one documentation regression-guard finding fixed and accepted; final local candidate accepted after independent manifest, full-suite, and diff readback.

No provider or account calls are involved. Existing four shard assignments and the historical receipt-v1 binding remain unchanged; the new integration stage belongs to other-a.