ci: validate equivalent staged native test budgets - #1070

The validator rejects the reviewed staged native-test budget when the equivalent -timeout=15m flag follows the package list. This adds a bounded, base-derived equivalence check and passes its verified policy to the full scanner only after every independent authority check passes.

The authority-boundary tests now read the existing CI YAML through a confined, hash-checked fixture reader. This removes the duplicated CI audit patterns from Go source, which caused the first head's AWS audit failure. Only the exact reviewed baseline and suffix-budget YAML hashes are accepted; both reproduce the original fixture bytes. The AWS audit itself is unchanged and still rejects a genuine banned import.

The total PR remains limited to the original five files: validator, validator tests, wrapper, authority fingerprints, and existing wrapper executable fingerprints. This correction changes one test file plus its mechanically derived wrapper/H/E hashes. The occupied 38-file staged bundle, policy contexts, command/action/presence/secret maps, module floor, guard, harness, native CI command, and permissions remain exact.

Validation:

• Exact reader source passed 45 focused cases for each reviewed YAML form, preserving all 32 original outcomes and four actual CLI crossings. Thirteen reader controls include missing, tampered, nonregular, oversized, and escaping paths.
• The unchanged three AWS gates passed against all 2,221 tracked Go files and both module files; an injected genuine banned import was rejected. The installed source also passes all three gates, gofmt, shell syntax, and the normal commit hook.
• The original and gofmt-normalized production Go ASTs retain the established equivalence proof SHA256 64844620aca08bd15a84952078d548c0c4bd8bced3e46c3e0958925e7ad42c08.
• A fresh local Go run stopped at setup before any case because the sandbox denied a shared-cache read. No retry, direct read, escalation, replacement cache, or alternative snapshot was used for that denied action. Fresh hosted policytool, guard, mutation harness, native, required checks, CodeQL, code-quality, and security evidence are mandatory on this head; historical head results do not transfer.

The owner approved the r154 reader correction and matching fingerprints on October 15 at 17:48 UTC within this PR's existing one-time admission. Admission is bound to source commit 46849af53dd688e968cbd23e001824a01e5d2714, tree 6f90db0e91998849d9be25cfbc0976f92d05f32b, and the same original five owners. It expires after PR #1070 and its first main policy event; exact restoration of those same five beforeimages remains the bounded rollback scope. The expected old-base policy rejection stays visible. No false success, AWS/native/required/security waiver, settings change, manual rerun, downstream work, or standing admission is included.

Related: #1066, #1069.