#16 CI only: external audit cleanup (cross-crate)

CI-only draft for a worker's Windows proof. Not for merging; the change reaches main through the gated push.

---

Summary by cubic

CI-only cleanup that consolidates duplicated helpers and fences test-only code behind a new test-support feature. No production behavior changes; the change reaches main through the gated push. Also fixes an oversight so staging inspections stay fail-closed: the test-support marker is read from ck-basal's checked strings table instead of a second read, and strings/nm failures are isolated per binary, so a later failed read cannot mask an earlier fail-open check.

Refactors

• Moved hex, poison-tolerant locking, position conversion, refusal text, settlement, and clock helpers into basal_proto::util.
• Dropped the unused agent_owned argument from configure_flow across all call sites.
• Split oversized functions in driver.rs, manifest.rs, and ops.rs without changing behavior.

Migration

• Mock hosts, fake catalogs, StaticResolver, ManualClock, FakeSelector, and the module harness now require cfg(test) or the owning crate's test-support feature.
• Aliased dev-dependencies keep package-qualified feature flags working under cargo test.
• Production staging now rejects binaries carrying the BASAL_TEST_SUPPORT_ENABLED marker.