fix(engine): wire ContainNode into break-glass + ledger self-revert (ADR-0040 §5)

[thejefflarson]

Summary

ADR-0040 §5 requires ContainNode to join the break-glass armed-set revert trigger
(ADR-0036) and the standard ledger self-revert lifecycle (ADR-0017) — but the existing
break-glass suite (engine/src/engine/break_glass_tests.rs) only knew the NetworkPolicy
cut shape (delete an engine-owned additive object). A cordon is a shared-field mutation,
not an additive object, and NodeContainmentActuator's revert doesn't fit the generic
single-mitigation Actuator trait (one ContainNode mitigation maps to many cluster
objects: the cordon plus one deny per co-resident pod). Routing a standing ContainNode
reversion through the generic network actuator would silently no-op (wrong object
kind/name) and leave the node cordoned after an operator hit break-glass — exactly the
gap this ticket verifies and closes.

What changed:

• Added NodeContainmentRevert, a narrow trait mirroring
  NodeContainmentActuator::revert's signature, so Engine's self-revert loop can hold
  either the live cluster actuator or a test double (mirroring how Actuator already lets
  KubeActuator and a recording double stand in for each other).
• Engine gained two dormant-by-default fields/builders
  (with_node_containment_actuator, with_node_fact) and a revert_contain_node helper
  (extracted to node_containment_revert.rs to stay under the 1,000-line file cap). A
  standing ContainNode reversion now routes through this path instead of the generic
  actuator, computing the co-resident deny set fresh from the current graph.
• The helper skips (never fabricates) when either half of readiness is missing — no
  attached actuator, or no observed NodeFact for the host — the same "no data ⇒ no pass"
  discipline node_containment's own module doc already applies to the cordon rails. When
  both are present, the actuator's own ownership self-gate (revert_decision, already
  landed in feat(engine): node containment actuator — cordon + co-resident default-deny (ADR-0040) #322) is what decides whether the uncordon actually happens.
• Updated node_containment.rs's module doc to reflect that the revert side is now wired
  while the apply side (the node arming rung, node observation, RBAC) remains a
  follow-up — explicitly out of this ticket's lane.

Deliberately does not touch: arming_ladder.rs, values.yaml, charts/, or add any
RBAC — that's the sibling ticket's lane (arming rung + node observation adapter +
apply-side rail wiring). The new tests synthesize a standing ContainNode mitigation
directly into the action log rather than relying on that rung existing.

Design decisions (recorded here since no ADR captures this exact wiring choice)

• A new NodeContainmentRevert trait, not an Actuator extension. Extending
  Actuator's signature would touch every existing implementor (DryRunActuator,
  KubeActuator, IsolationActuator, test doubles) for a shape only ContainNode needs.
  node_containment's own doc already establishes that NodeContainmentActuator
  deliberately isn't Actuator-shaped (one mitigation → many objects) — the new trait
  keeps that boundary rather than blurring it.
• NodeFact fleet as an Engine-attached map, not a Snapshot field. Real node
  observation (watching Kubernetes Node objects) is explicitly the sibling ticket's lane.
  Adding it to Snapshot/observe::Snapshot::observe would collide with that work, so this
  ticket exposes a narrow seam (Engine::with_node_fact) a future observation adapter can
  populate, and leaves it empty (safe no-op) until that lands.

Test plan

• New file engine/src/engine/break_glass_node_tests.rs (5 tests), driving the real
  proof → boundary_break → menu-resolution → ledger pipeline (a live kernel-tamper
  runtime signal on an internet-exposed entry scheduled on a node with a co-resident
  labelled pod), with EnabledActions::enable(ProposedAction::ContainNode) used directly
  (bypassing the not-yet-built arming rung) and the "already applied" step synthesized
  into the action log:
  • engaging break-glass uncordons the node AND lifts every co-resident deny within one pass
  • the ledger self-reverts on the standard lifecycle once no chain still carries the
    workload as a boundary-broken target (no break-glass involved)
  • revert skips a node lacking the ownership annotation (asserted via the double's own
    counters, exercising the real revert_decision rail)
  • revert skips when no NodeFact is observed for the host (the "no fabricated no-data
    pass" discipline)
  • clearing break-glass leaves the node class's proposed posture byte-identical to never
    having engaged it (adapted from clearing_break_glass_restores_the_configured_posture_byte_identical
    — ContainNode never auto-applies, so the honest mirror is that the ledger's
    proposal itself is unperturbed by disarm)
• cargo fmt --check — clean
• cargo clippy --lib --tests -- -D warnings — clean
• cargo test --lib — 1184 passed, 0 failed, 2 ignored (pre-existing, unrelated)
• cargo build --workspace — green
• soundcheck pr-review (self-run) — no Critical/High findings (internal engine logic,
  no new external input/auth/secrets surface)
• /simplify (self-run, single-pass — Agent tool unavailable in this context) — found
  and fixed one duplication (a test fixture rebuilding tests::exposed_snapshot's shape
  by hand instead of reusing it)

Closes JEF-733