Roll up integration-fkst-loning-s-macbook-m5 into dev

[fkst-loning-s-macbook-m5]

Summary

Roll up 3 commits from integration-fkst-loning-s-macbook-m5 into dev, ending at immutable head 9df854432c9c3f88205c1db0e12f32de190c4bb6.

• Allow canonical explicit external package roots when the host has no package catalog.
• Preserve mandatory package catalog ownership and fail closed when a catalogless host contributes graph content.
• Add focused unit, graph-scan, and live supervise coverage for cross-package event delivery.
• Includes merged PR github-devloop implementation for #409 #410 for issue A target whose packages all come from explicit --package-root still requires fkst.workspace.toml #409; pre-merge CI and the post-merge probe passed.

中文摘要

将集成分支的 3 个提交汇总至 dev。本次变更允许无 host catalog 时使用显式外部 package，同时保留 package 所有权校验和 host graph 的 fail-closed 约束，并补充跨 package 投递测试。
⟦AI:FKST⟧

[fkst-loning-s-macbook-m5]

github-devloop-integration rollup observe sample

status=clean
reason=clean
head_sha=9df854432c9c3f88205c1db0e12f32de190c4bb6
first_clean_observed_at_ms=1787437156475
sampled_at_ms=1787439160499