fix(azure): stabilize R4 fixtures and OpenCode scope

[ruby-dlee]

Summary

• make the teardown address-pinning fixture hermetic on minimal Linux images without ip or ifconfig
• execute tracked OpenCode plugins as byte-identical ESM fixtures on Node 18 and newer
• arm the watcher in valid marked secondmate own homes while keeping child crew and scout worktrees silent

Verification

• full networkless teardown suite, 147 cases
• OpenCode watcher suite on Node 18 and current Node
• full turn-end guard suite
• behavior shard plan and suite seal
• full pinned shell lint and Node lint
• independent adversarial review: clear