fix(wfctl): preserve Docker resolver failure evidence - #1067

Record-host failures during Docker resolution currently report only docker_resolve with an unknown operation and exit status. Report a closed failure stage and, for the existing initial context-inspect or daemon-info command, its observed cancellation, inner deadline, capture overflow or command exit. Metadata/config failures retain a closed stage with unknown operation and exit.

The opt-in diagnostic keeps its 11 fields and excludes raw errors, output and private values. The first failure freezes phase, operation and status together; successful resolution leaves later child failures free of stale resolver status. Existing commands, timeouts, error returns, transport/TLS checks, process custody, cleanup and public stdout remain unchanged.

This source is refrozen on accepted main 38b877be, which already contains the native test package budget change. Only the three resolver/diagnostic files differ from main; all 3,529 other tracked files and modes are identical. Original source and failed CI history are retained. ADR0194 moves this existing diagnostic boundary before the blocked policy-floor adoption without combining their file owners.

Regression coverage adds 18 real helper/resolver/parent cases across four new diagnostic test parents, including both commands, cancellation and inner deadlines, capture overflow, malformed metadata, literal opt-in, exact call counts, secret exclusion, parser rejection and concurrent first-failure preservation. Existing later-child-failure controls also assert that successful resolution leaves no stale resolver status.

Static inventory and diff checks pass. Fresh hosted CI 38843618608 passes on head b4ee648b833d6f2346c05ca5fb51d3624c404cee, tested merge 9c90e23ff029806a1827cfae216788a59f239299 with the same source tree. The actual native race/coverage run passes all 153 packages, 17 diagnostic parents, all 18 new resolver cases, 18 fixture contracts, eight capability checks and both real CLI Go1.27.2 metadata checks. The live Docker sandbox passes in 5.22 seconds; all four required checks, both normal trusted-base policy scans, the complete public workflow policy fixture harness, CodeQL and Code Quality pass. Fresh local heavy execution was not performed while another task owns that slot.

The official OSV differential reports no added or removed findings: all 372 full occurrences are identical. Both scans still have 14 module-loading errors because scanner Go1.26.2 cannot load modules requiring at least Go1.26.5; analysis remains UNKNOWN/incomplete and is not security-clean. Only the existing ADR0187 named-Task31 prerequisite timing applies. The benchmark validator fails on unsupported Go listing output and remains the existing B14 advisory; no performance pass is claimed.

Two independent Source3 reviews and two independent Own3 reviews pass with zero findings across all 15 required bug classes. The owning reviews assess the complete terminal native, policy, scanner, benchmark and protection evidence. This adds tested failure evidence; the original live-resolver cause remains unproved and was not reproduced in this run. Protected integration, actual-main CI, automatic snapshot provenance and final-main acceptance remain separate checkpoints. Original failed evidence and review history are retained.