feat(worker,runner): the portfolio snapshot in, the priorities plan out, and the portfolio persona

[edgehero]

Refs #505 (part B, the last of two). Closes #505 together with #575.

A flagged cron job now sees the budget split as a read-only snapshot, can hand back a priorities plan through its outbox, and the worker applies that plan under the same rules as an operator's, after the container has exited.

The snapshot in

• /job/portfolio.json, read-only, built when the job is prepared and only when the job was flagged at pickup and the live triggers file still flags the same entry. A plan is applied only when the pickup, the prepare step (which wrote the snapshot) and the live file at collection all agree.
• It holds ids, digests, integers, ISO instants, enum tokens and operator labels only (a label with control, format or bidi characters is replaced by the member's ref): the envelope numbers, the current plan's id and writer, the last attempt's outcome, and per project its floor, weight, share and spend (spent plus still held, read from the same counters enforcement uses), its members, and its last seven days of run outcomes. No issue text, no titles, no plan reasons and no paths.
• A Valkey fault while building it is retried before anything is spent; a snapshot over 64 KiB refuses the job before it spends as portfolio-snapshot-oversize.

The plan out

• The job writes /outbox/priorities.json, a separate file from chain requests, so it never uses a chain slot and an older worker never misreads it.
• After a completed exit, the collector checks, in order: still a portfolio job (plan-not-portfolio), a file it can read (plan-unreadable), size (plan-oversize), a regular file opened without following links (plan-not-regular-file), JSON (plan-parse-error), the plan contract (plan-invalid plus the field), and then applies it as writer portfolio-job under the envelope's rules. It never throws, so a refused plan never turns a completed job into a retry; a fault inside it is recorded as plan-collect-error.
• Every outcome lands in the run record as plan. The portfolio job's own attempts also land in the audit file and in alloc:log, and the next snapshot's last attempt tells the next run what happened. A plan file left by any other job is refused in its run record only, so no ordinary job can crowd the panel's history. plan-collect-error means the outcome is unknown and the plan may have applied; the record still carries its plan id.

The persona and the pre-check

• guardrails/PORTFOLIO_PROTOCOL.md is baked into the image and composed into the system prompt only when /job/portfolio.json exists, decided once when the loader is built, so the prompt stays the same on every turn. It explains the snapshot, the plan, the basis rule, and that the host decides after the job exits.
• Before its exit line, the runner checks the plan's shape and logs refusals so the agent's log shows them. It never changes the exit code or the exit line.

Specs

AMENDED: INT-CONTAINER-JOB-INPUTS, INT-OUTBOX-CONTRACT (a second file and its order of checks), INT-RUN-HISTORY-FILE-CONTRACT (plan, the new reasons), INT-PRIORITIES-PLAN-CONTRACT, DES-JOB-OUTBOX-CHAINING (a second kind of request; the rejected type key on a chain request), DES-DELEGATED-ALLOCATION-INSIDE-ENVELOPE, SECURITY.md (the portfolio plan rows). UNCHANGED, checked: REQ-AI-TRIGGERED-RUNS (a plan enqueues nothing).

Tests

The snapshot byte for byte with a planted issue title absent, every collector refusal in order, a symlinked plan file, manual and chained jobs refused, a flag removed after queueing, re-collection as plan-duplicate, the processor collecting only on a completed exit, the persona present or absent with an identical prompt across turns, the pre-check never changing the exit, and a live Valkey race between a job's plan and an operator's apply. Each rule was checked by reverting it and watching its test fail. The by-hand steps of #505 were run with a local model priced through the overlay.