fix(wfctl): bound Docker daemon identity requests - #1072

wfctl pipeline record checks Docker daemon identity before establishing custody and before each operation. The formatted docker info path also enumerates unrelated client-plugin metadata. Replace it with the pinned CLI's system dial-stdio transport and one bounded GET /info, preserving the existing five-second limit, selected endpoint/TLS configuration, private files, process-group cancellation, diagnostics, and output limits. Docker initialization can still ping; the historical main timeout's precise cause remains unproved.

Keep stdin open through CLI completion and require a complete successful bounded HTTP response with one valid daemon ID. Preserve separate DNS Lookup and wire HTTP Host policies, including uppercase internationalized names, ASCII authorities, and IPv6 routing scopes. The only module change marks the existing x/net v0.59.0 requirement direct; versions and checksums are unchanged.

Fresh local verification on the exact source tree: focused race tests (16 parents, 85 subcases), compiled-fixture race tests (4 parents, 12 subcases), vet, official golangci-lint 2.14.0, and root go mod tidy -diff all pass. Both independent Source3 reviews are SHIP-IT with zero Critical/Important and two acknowledged Minor findings, covering scope and all 15 required bug classes.

Natural owning CI 38871790332, attempt 1, passed all 13 jobs on exact source 7b7523a1 / tested merge 5f1a2251, both tree e7a9d4a6. All 153 packages ran uncached; cmd/wfctl passed in 509.796 seconds. All 18 fixture contracts, eight capability cases, both Go 1.27.2 CLI fixtures, linked-version checks, and the actual live Docker sandbox (5.31 seconds) ran and passed. All four strict Actions checks, CodeQL's three analyses, Quality's two analyses, and the policy positives/full fixture harness passed.

The full old/new OSV reports contain byte-identical 351 finding records. Each phase also has the same 13 module-loading failures because scanner Go 1.26.2 cannot load modules requiring 1.26.5. The differential reporter/job succeeded; analysis remains UNKNOWN, AnalysisComplete=false and SecurityClean=false. Both Own1 Important seals remain valid under the former IQ7 text. Under Jon’s explicit direction, independently reviewed ADR0197/KS1–KS4 now prospectively carries the earlier same-known, nonrequired OSV engineering-prerequisite timing to necessary corrective36 through unchanged reviewed source1022 integration expiry. It preserves every required check, full current risk/error assessment and new-risk stops; Task35 does not inherit it. The correction is committed/pushed in workspace85dffba1c, with all17 lock files unchanged. Fresh Own2 integration reviews are underway on the unchanged source/native evidence; protected integration, genuine actual-main/snapshot and final acceptance remain due.

The advisory benchmark workflow genuinely failed validation: a Sonic Go-version compatibility warning was the first line of its benchmark listing. Its comparison is NOT RUN; no performance regression or improvement is claimed and no rerun was requested.

Acknowledged Minor fixture limit: the compiled helper's generic TCP Host oracle cannot reconstruct an original uppercase IDN from a normalized dial endpoint. Its current context is fixed Unix, so that pair is unreachable through the compiled fixture CLI. Production lower/uppercase IDN and ASCII routing, verified TLS/SNI, wrong-name rejection, and operation rechecks cross the separate selected-helper tests and real local sockets. This does not claim arbitrary TCP support for the compiled fixture.

Acknowledged Minor input-hardening limit: an invalid, overlong Unicode authority from owner-controlled Docker context configuration is Punycode-serialized in the parent before the 512-byte wire limit rejects it. The CLI's five-second timer starts afterward. This is not a measured delay or an explanation of the historical native failure; a conservative pre-normalization bound remains a follow-up.

This is the separate Task36 correction under ADR0195/0196, not Task25's H-only promotion or Task34's four-map promotion. The actual-main e517 required failure remains recorded; Task25/34 stay blocked until corrective main acceptance and fresh reevaluation. The only security-timing correction is the narrow ADR0197 prerequisite disposition above. No required-check override, scanner disabling, runner change, credential issuance, manual release, or deployment is included.

The upstream GOTOOLCHAIN=auto repair is retained as an unapplied six-line candidate. Installed policy explicitly forbids this variable and requires staged trust/authority transitions, so the candidate has not been tested or inserted here; no loading error is claimed fixed and no additional scanner project was started.