Harden CI for Experiment development

[xor-machine]

What changed

• add fixed fast and Docker suite and subprocess-phase deadlines
• terminate timed-out process groups with bounded TERM/KILL cleanup
• enforce exactly one exact completion marker as the final non-empty line
• bind fast and Docker manifest fixtures to exact markers
• document the deadline and marker contract

Why

The fast gate previously bounded captured output but could wait indefinitely for a suite, and a marker substring printed before cleanup could satisfy the completion check. This hardens the existing harness before new suites are added.

TDD evidence

Cycle	Assertions	Pre-implementation	RED	GREEN	Mutations
Gate foundation	CI-001 through CI-011	91cf4be	4fa1107; focused contracts reached deadline and exact-marker assertions; rc 1	1cf601c; focused gate, concurrency, and Docker harness contracts; rc 0	deadline removal, leader-only cleanup, and premature-marker private copies each produced the named RED result; tracked source remained unchanged

Validation

• bash tests/dev/security-gate-cases.sh — pass
• bash tests/dev/security-gate-concurrency-cases.sh — pass, including private-copy sensitivity mutations
• bash tests/dev/docker-harness-cases.sh — pass
• ./scripts/dev/lint-scripts — pass
• ./scripts/dev/check default quick — pass in an isolated clone with pinned CUE/Cedar tools; 29/29 suites
• ./tools/validate.sh — pass
• ./tools/containment-lint.sh — pass

The shared checkout replay correctly failed the Serena mount fixture because .git is exposed there as a child mount. The isolated committed-tree replay removed that environment artifact and passed. No Docker runtime suite or non-Linux platform claim is included.