ca-pi: runtime-resolver fail-closed branches mocked out in only covering test (coverage-002)

[SUaDtL]

Branch: feat/pi-support · Tribunal run 2026-07-17-pi-support-branch · Finding: findings/coverage/coverage-002.json
runtime-resolver.ts:105-159 anti-tampering logic is vi.mock'd in runner-isolation.test.ts:49-51; no test exercises the real fail-closed branches.

[SUaDtL]

Verified against PR #313 head 9ed248f4: test/runtime-resolver.test.ts copies the real resolver source byte-for-byte into isolated package fixtures and directly exercises its fail-closed identity, containment, version, and tampering branches. runner-isolation.test.ts still mocks its collaborator for runner isolation, but it is no longer the only coverage. The hosted Pi adapter matrix is green. This finding is implemented on #313, which now carries Closes #317.