#916 Harden SDK execution, extension topology, contracts, and exact coverage

Outcome

This broad SDK/CLI tranche strengthens the universal context-management substrate across six coupled trust boundaries:

• makes strict cross-owner seeded Plan creation atomic;
• preserves ancestor runtime dependency resolution in fresh extension activation probes;
• keeps extension package assets outside item merge drivers while retaining structured managed-state merges;
• makes pm contracts --full monotonic by retaining command summaries and output policy;
• enforces exact 100/100/100/100 coverage locally and in hosted merged coverage, with fail-closed malformed-report and rounded-percentage negative controls;
• refreshes compatible tooling to tsx 4.23.8 and pm-changelog 2026.8.6 while retaining the separately tracked incompatible major-version deferrals.

PM lineage

• pm-hxuqsa — atomic strict Plan creation
• pm-pg9599 — extension runtime topology
• pm-t9qbmp — merge-driver asset scope
• pm-x0iv17 — complete contracts projection
• pm-2qqcgl — exact local and hosted coverage gate
• pm-l9fv1e — compatible tooling refresh

Fixes #910
Fixes #911
Fixes #912

Verification

• 438 test files and 6,887 tests pass.
• Exact coverage: statements 49,165/49,165; branches 35,658/35,658; functions 10,051/10,051; lines 47,645/47,645.
• Static quality, 100% docstrings, SDK import boundary, token/context calibration, tracker measurement, changelog freshness, production audit, secret scan, and 88-command package-first dogfood pass.
• Fresh-workspace manual proof covers strict cross-owner Plan persistence, full contracts, Git attribute resolution, package activation, and zero module-snapshot residue.
• Tracker storage/history and merge-fence integrity are clean; the existing historical missing-resolution population remains an explicit warning, not new drift.

---

Summary by cubic

Hardens SDK/CLI trust boundaries: atomic Plan creation, accurate extension activation, safe merge-driver scope, monotonic contracts, and an exact coverage gate enforced after shard merge. Fixes #910, #911, and #912, and updates tsx to 4.23.8 and pm-changelog to 2026.8.6.

• New Features

  • Enforced exact 100% coverage using integer counts; CI merges shard reports using coverage-shard then runs scripts/release/coverage-threshold-gate.mjs; added a negative-control unit test.
  • Made contracts monotonic; the full projection preserves command_summaries and output_policy; refreshed the full structured contract fixture.

• Bug Fixes

  • Restored atomic seeded cross-owner Plan creation under strict ownership; commits all-or-nothing.
  • Preserved hoisted runtime dependencies during extension activation probes by snapshotting under the project parent and cleaning all temp graphs.
  • Excluded .agents/pm/extensions/** from item merge drivers; kept JSON merge for .managed-extensions.json.