[codex] prove managed plugin convergence

[TheGreenCedar]

Context

Issue #997 needs installed managed-plugin evidence that stale local state and absent sidecars converge through project activation while status stays observational. The existing packaged proof already owns the six-platform managed-plugin lane, so this extends that gate instead of adding another harness.

What Changed

• Extend the existing managed plugin handoff proof with a stale isolated fixture, ownership snapshots around status, one project-scoped ground activation, terminal shared-agent repair polling, publication-generation checks, and accelerator fail-closed assertions.
• Strengthen the A/B/A multi-project protocol contract for roots, storage, workspace identities, ownership labels, broker operations, and stable repeat routing.
• Update the testing matrix and changelog to describe the stronger managed convergence evidence.

How To Review

1. Review .github/scripts/check-packaged-agent-proof.py from fixture setup through require_managed_plugin_convergence.
2. Review the A/B/A assertions in stdio_protocol_contracts.rs.
3. Confirm the existing six-target packaged-agent matrix still invokes --managed-plugin-handoff.

Verification

• cargo build --release -p codestory-cli
• cargo test -p codestory-cli --test stdio_protocol_contracts multi_project_stdio_routes_interleaved_requests_by_explicit_project -- --nocapture
• Packaged Windows x64 managed proof against the locally packaged release binary: passed. It observed stale generation 1, converged fresh at generation 3, retained one shared-agent repair attempt to a durable terminal failure caused by the deliberately absent embedding model, kept packet/search closed with gpu_unverified, and matched the server checksum to the managed binary.
• python .github/scripts/check-packaged-agent-proof.py --self-test
• python -m py_compile .github/scripts/check-packaged-agent-proof.py
• node .github/scripts/check-workflow-policy.mjs
• node .github/scripts/check-doc-links.mjs
• cargo fmt --all -- --check
• git diff --check

Risk

The new live managed convergence path adds time to each packaged-agent matrix job. Windows x64 is proven locally; Linux, macOS, and the remaining architectures depend on this PR's existing CI matrix and are not claimed until those artifacts pass. The WSL self-test could not complete locally because that distro has no Linux Node.js executable; the native Windows self-test passed.

No screenshot-visible UI changed.

Closes #997
Refs #897
Refs #1001
Refs #1031