fix: harden Cortex contracts, recovery, and release validation

[jmagar]

Summary

• add durable Cortex session streaming and rendered-session integration contracts
• harden runtime shutdown, integrity maintenance, file-tail persistence, notification routing, Compose execution, and agent deployment
• make backup and container-release validation fail closed across CI and production deployment paths

Verification

• cargo fmt --all
• cargo clippy --workspace --all-targets -- -D warnings
• focused runtime, integrity, file-tail, deployment, workflow, setup, and denominator tests
• cargo xtask check-version-sync
• plugin marketplace validation (45/45)
• Compose rendering and backup permission checks
• live container release smoke over HTTP, TCP syslog, and UDP syslog

Review scope

This PR includes the seven existing palette/Labby/Cortex contract commits plus the repo-wide P0-P2 remediation commit. The PR will remain under iterative review until all actionable findings and relevant CI failures are resolved.