fix: complete full-validator repair and refresh diagram

[Brian Krabach (bkrabach)]

Summary

Publishes the tested conflict-resolution merge commit 89cb770, integrating this validator-launcher repair with current main. The repair keeps full validation genuinely full and fail-closed: it uses the normal Foundation dependency closure with a Foundation override, selects exactly one explicit or cached validator recipe, preserves the caller's Amplifier identity, and cleans up a newly owned external environment on either outcome.

The prerequisite has landed: Foundation #395 merged as f13d081, whose post-merge CI run passed all six jobs.

Scope / guardrails

The delta from current main is limited to eight paths: AGENTS.md, CONTRIBUTING.md, .github/PULL_REQUEST_TEMPLATE.md, scripts/validate-full.sh, tests/test_validate_full.py, tests/test_validate_full_launcher.py, bundle.dot, and bundle.png.

The merge preserves current main; runtime README, skills, locks, agents, hooks, modes, tools, and server behavior are not changed by this PR. It introduces no runtime CI seam change. The wrapper still keeps the environment outside the inspected target, refuses pre-existing explicitly requested locations, retains the no-ERROR-waiver rule, and performs cleanup on success and failure.

Verification

• Module tests pass — tool-context-intelligence-query: 195 passed; transcript module: 34 passed.
• Top-level tests pass — tests/: 898 passed, including 20 launcher tests.
• ruff check + ruff format --check clean — locked Ruff 0.15.11, 180 files.
• pyright clean — 0 errors, 0 warnings.
• Full bundle validation PASS — scripts/validate-full.sh used the merged Foundation validator revision and reported env_check.validation_mode: full, build_check.build_tested: true, and build_check.build_success: true; quality_classification.quality_level: polish with 0 critical and 0 ERROR findings. final_report: PASS WITH SUGGESTIONS. No ERROR waiver, filter, or suppression was used.

Real evidence on seams (not mock-only)

• The validator-launcher path was exercised in a fresh DTU through the actual wrapper and its normal dependency resolution. The merged Foundation revision was resolved through a verified public direct URL; no local source injection or alternate install path was used. The fresh end-to-end run completed every required step, including conditional skips, and the ephemeral environment was removed afterward.

Docs & diagrams

• bundle.dot / bundle.png were checked by the full validator: no BUNDLE_DOT_STALE; canonical regeneration left both artifacts byte-identical with all 14 composition relationships preserved.
• N/A — no tool or skill contract changed; README, skills, and runtime agent behavior are deliberately untouched.
• AGENTS.md, CONTRIBUTING.md, and this template record the durable full-validation/operator guidance.

Notes / follow-ups

• Independent architecture review and source-whitelist review passed for the integrated candidate.
• The full report retains two real advisory categories: navigation metadata for three tools and the server-data-ops agent-description length (1081 characters). They remain suggestions; this PR does not claim zero warnings.
• Breaking changes: none.

[Brian Krabach (bkrabach)]

Dependency update: Foundation PR #395 carries the v3.16.1 mode-path and diagram-composition repair. Local candidate 6de49f509bbf238794dbc446ec3542eaab7244b7 includes the regenerated diagram and its full gate is PASS WITH SUGGESTIONS (no ERRORs), superseding the remote cfb8d9a09722750e8708307195507195e817be97 check state. This PR remains a draft; final source push is deliberately held until the Foundation dependency lands and its CI is clean.