feat(azure): add pinned no-mistakes worker transport

[ruby-dlee]

Summary

• add the supported Firstmate wrapper for no-mistakes review, repair, and test jobs
• bind every request to an exact runtime identity, source head, payload digest, and lifecycle source revision
• package a credential-free Linux Pi runtime with fast mode and Ketch
• select one Azure Codex profile under controller custody and project only that profile into an isolated guest
• return bounded semantic outcomes and repair bundles through the existing lifecycle cleanup path

Verification

• focused wrapper, runtime, lifecycle, result transport, and shell checks passed
• the runtime builder smoke-started Pi 0.84.2 with fast-mode 0.3.0 and Ketch 0.1.6 on Linux amd64
• the full worker lifecycle suite passed after merging current main
• cold adversarial review returned CLEAR on post-main head d5c6ccb90b9c3e4935c47ebdc93914e15f067be2

Size

The transport, lifecycle bindings, sealed runtime, result verifier, and regression fixtures are one security and cleanup boundary. Keeping them together prevents an intermediate revision from launching a guest whose output or cleanup cannot be admitted safely.

Release

The custom transport must land before a billable live proof because Firstmate correctly refuses Azure mutations from unlanded source. Do not merge without the captain's explicit approval.
Merge with a merge commit, not squash or rebase, so the reviewed source revision itself becomes reachable from main and passes the Azure source fence.