fix(crosscheck): isolate verdict repair after provider failures

[ruby-dlee]

Intent

Harden Azure Crosscheck after two real consumer failures. Preserve exact-head binding, isolated Azure model/tool/verifier compartments, credentialless evidence verification, cleanup guarantees, and fail-closed semantics. Keep exactly one bounded structured-verdict repair. When an xhigh reviewer hits its output limit, the repair must not inherit the oversized transcript or repeat the same failure: use one fresh ephemeral minimal-reasoning attempt over the identical exact-head review packet. Preserve bounded, sanitized provider error diagnostics, internally consistent failed-run telemetry, executable regressions, and lightweight operator documentation. Do not use Bugbot; adversarially self-review, ship through a PR, merge, deploy immediately, and rerun Relvino PR kunchenguid#1514 until it returns an admitted verdict.

What Changed

• Run the single bounded Pi verdict repair as a fresh, sessionless minimal-reasoning attempt over the identical exact-head review packet.
• Include sanitized, whitespace-normalized, 512-character provider diagnostics in fail-closed terminal-error output.
• Extend Azure Crosscheck regressions and operator documentation for isolated repair, terminal errors, telemetry aggregation, and diagnostic bounds.

Risk Assessment

✅ Low: The repair is well-bounded and source evidence supports the required fresh-session retry, fail-closed behavior, sanitized provider diagnostics, telemetry aggregation, and executable regression coverage.

Testing

Completed 1 recorded test check.

• Outcome: ⚠️ 1 error across 1 run (15m8s)

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

🔧 **Review** - 1 issue found → auto-fixed ✅

• 🚨 bin/fm-crosscheck-pi-reviewer.py:176 - The required “bounded, sanitized provider error diagnostics” contract is not met: " ".join(error_message.split())[:512] bounds length and normalizes whitespace, but preserves non-whitespace control characters such as ANSI escape sequences. A provider-supplied errorMessage can therefore inject terminal controls when the exception is printed. Sanitize to a safe printable representation before appending the bounded diagnostic.

🔧 Fix: Sanitize bounded provider error diagnostics
✅ Re-checked - no issues remain.

⚠️ **Test** - 1 error

• 🚨 tests failed with exit code 1
• if [ "${FM_AZURE_VALIDATION_CELL:-0}" = 1 ]; then exec "$FM_AZURE_VALIDATION_SHARD_BRIDGE" behavior --count "${FM_AZURE_VALIDATION_SHARD_COUNT:-8}"; else exec bin/fm-no-mistakes-test-command.sh; fi

✅ **Document** - passed

✅ No issues found.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.