v6.1.7 services stack: integration fixes + green gate

Supersedes v6.1.6 (whose tag missed the art-data source half — landed here).

Commits over v6.1.6: a6d258a (leftover art-data sources: delete confinement, decompression-bomb guards, loader caps, Kiwix caps, native pin float), 9e3cf53 (hermetic CUDA test, vendor-blocked extras skip-with-cause), 178a705 (P03 exec-bit fixture fix).

Gate: full services suite 1426 passed, 24 skipped, 0 segfaults (order-dependent CUDA flake #2276-class fixed by hermetic mock; fp8 file still excluded per #2276). Remaining red, all classified: functional qwen e2e needs CUDA llama build (#2416, env), P05 scipy collect-parent missing from venv (pre-existing env gap), 15 vendor extras skip-with-cause until airunner-tts-vendor is published (#2413), ollama parity 501s in parity-worker's lane (#2415). Still open: #2274 dep majors (blocked upstream), #2358/#2363/#2364/#2365 owner-decision, #2399 docs follow-up.