fix(wfctl): retain safe failure evidence for record-host tests - #1065

The live record-host sandbox test previously reported only pipeline_failed, losing the failing operation and cleanup evidence. Add an explicit failure-only diagnostic opt-in with closed phase/status fields, preserve the public record protocol, and report only validated statuses, fixture digests and bounded cleanup counts in the synthetic test.

Deterministic committed tests inject Docker create/attach/wait/status and cleanup failures, synthetic child exits/signals, malformed reports and concurrent observations. Existing assertions, timeouts, race mode, authority manifest, workflows and module pins are unchanged.

This is the separate Task30 diagnostic repair under ADR0186/DR1–DR6. It does not establish the cause of snapshot38643952510 attempt1 or repair production behavior. That original failure remains preserved. Local Go validation stopped at a managed-sandbox denial reading the existing shared Go build cache; no denied-read retry or cache substitution occurred. Prepared-source reviews precede publication; this natural CI must actually execute the injected tests, race/native suite and compatible lint before integration. Actual main/snapshot/final reviews and explicit forward Task23 admission remain due.

The first natural attempt at def8159 is preserved as failed: 12/13 diagnostic parents, the original live Docker test, all18/eight contracts and both real CLI1272 consumers passed; image-setup TempDir cleanup and QF1008 lint failed. The same-scope correction isolates that synthetic subprocess working directory/PATH, disables automatic Go downloads only there, asserts no private Go cache subtree and uses the promoted ExitCode selector. It does not alter production runtime behavior, cache policy, deadlines or assertions. New exact-source natural CI evidence is required; prior successes are historical only.