fix: refuse resource operations in bounded composites
Summary
Bounded batch/replay refuses resource operations before step effects. Nested typed refusal stops CLI and manifest retries after one attempt; ordinary resource-free failures still retry. Earlier progress and replay repair/resume remain. Ref #3325; dependent #3911 still requires its own integration and validation.
Exact head b920c2333b03031d3221a120b1040a6d9de9f8e2: 33 files, 1,923 gross lines from base. Its only change from a6fd is Linux apt setup diagnostics: ordinary output and UTC update/install stage markers. The six-minute limit, apt options, packages and failure exits remain. This identifies a future stalled phase; it is not a proven repair.
Validation
Exact clean b920 affected gate run-1vTiRz passed 834 related files/6,474 tests; fresh full Sol and Claude Sonnet workflow reviews found no findings. Runtime is byte-identical to a6fd. The a6fd exact gate, full reviews and Android live one-attempt/journaled-home/IME cleanup proof retain a6fd attribution; journal counts are not universal native-call counts.
The 56c0 and a6fd Linux apt setup attempts failed before smoke execution. One targeted 56c0 retry passed only 56c0. b920 CI completed: 17 success, one skipped, one neutral, including Coverage, Integration and all three platform smokes. SHA-attributed evidence. No merge or full #3325 completion claim.