fix(runtime): serialize mailbox work and settle participant processes

Description

The pitch.

## Summary

- Serialize mailbox claim/ack/reoffer decisions with their writes and evidence events; finish is atomic/idempotent and terminal runs reject subsequent mutations.
- Bound MCP initialization/tool-list probes by wall time and output size, and settle participant process groups before final export on POSIX.
- Preserve trusted custom-command environments, narrow bundled environments, preserve hosted-model proxy settings, and default kiosk models to mock unless explicitly enabled.
- Record external command/A2A/wait participant provenance honestly. Omit commands/endpoints from rerun metadata and identify inputs the operator must resupply instead of substituting bundled agents.

## Boundaries

This is not a hostile-code sandbox. Non-POSIX cleanup currently covers direct children. Grant expiry remains a join-time check; this does not introduce continuing revocation or a new identity policy. No remote/LAN agent restriction is added.

## Verification

Fresh standalone base: `53178b9c780d7a7dd6ce723131c4250de03908dd`.
- `python -m pytest -q` on Python 3.12 — 683 passed, 8 existing warnings.
- `git diff --check` — clean.
- Regressions include two-connection/concurrent mailbox operations, duplicate reoffers, terminal mutations, real subprocess deadlines/descendants, repeated cleanup and external rerun redaction.
- Independent review reproduced and cleared duplicate reoffer fencing, repeated process-group signaling and hosted proxy regressions. A real loopback ModelClient proxy check passed; planted command/A2A secrets were absent from generated evidence.

Combined remediation separately passed all 817 tests on Python 3.12 and the clean Python 3.11 wheel. This PR is independently based on main; the current-manual PR documents its final boundaries.