fix(testing): harden production admission readiness

[YueZh127]

Summary

• fail new Testing submissions closed before placement or QARun persistence when the claim signing key, complete start-and-reconcile Authorization provider, Runtime fact verifier, Cleanup verifier, external schema authority, or placement dependencies are unavailable
• preserve canonical idempotent replay for an already accepted identical QARun before admission gates
• build production-only control-plane, worker, and Testing Protocol distributions; final images exclude tests, test-support modules, PQL fixtures, fixture authorities, and test literals
• map Runtime fact verifier outages to stable retryable HTTP 503 responses, document worker result/reconcile 503s, and expand schema-authority fail-closed coverage

Authority boundary

This PR references #12 but does not close it. Production Authorization, Runtime fact, Cleanup receipt, and external schema adapters remain blocked until the owning repositories publish formal endpoints, authentication, versions, and digests.

No production secret, temporary endpoint, fixture-derived authority, or second authoritative external schema copy is introduced.

Verification

• npm run build
• npm run typecheck
• npm run lint
• npm run build:control-plane-runtime
• npm run build:worker-runtime
• npm run verify:runtime-distributions: Testing Protocol 18 files / 6 modules; control plane 84 / 28; worker 87 / 29
• npm run bundle:worker
• npm run generate:testing-fixtures with no drift
• npm test: 284 passed
• npm run test:mongo-contract: 10 passed
• npm run demo:testing-contract
• npm run demo:testing-contract -- --json
• GitHub CI: Contract and build, Test, Runtime images, and Contract demo succeeded; Runtime images extracted and verified the complete /app surface of both final images

CI note: the first Test attempt surfaced the existing interactive worker-proxy completion race (409 between sequential actions); the single failed-job rerun passed without a code change. The image/build/demo jobs passed, and the race remains outside this Testing PR scope.

All five commits received focused read-only subagent reviews. The independent full-PR review found one P1 final-image fixture leak; commit 319b5b6 fixed it. A follow-up review found that start-only Authorization providers could be misclassified as admission-ready; commit 49d08b6 now requires both start and reconcile authorization capabilities. The same reviewers re-reviewed both fixes with no remaining findings.

Preflight

• base: qa-tools@2cff6a5edb520809955c22bfce553d7a2625cfe7
• head: codex/testing-admission-readiness@49d08b68878bcbf19970008c25e5602e8120dbd8
• related: P0: Add production Testing authority providers and fail-closed adapters #12 (remains open)