Confine gate capture descriptors

[chasebryan]

What changed

• capture the authoritative tracked-source archive and path inventory in read-only file descriptors
• unlink both capture names before copied Python or Rust code executes
• close the trusted descriptors in every run_cargo child and assert that isolation at runtime
• extend the protected Makefile contract and mutation tests for descriptor setup, closure, and unlinking
• document the strengthened boundary and its residual same-account /proc trust assumption

Why

The hardened compiler gate previously kept its authoritative source archive and path inventory as named writable files inside the child-visible Cargo home. A compromised admitted child could potentially alter and consume those files during later extractions, then restore their original bytes before the final identity check. Removing the names and withholding the descriptors from copied code closes that replace-use-restore window.

Impact

This does not change Orange language behavior. It strengthens the repository validation gate by restricting later capture access to trusted shell operations while preserving reproducible extraction and final byte-for-byte comparisons.

Validation

• git diff --check
• 10 focused ProtectedControlHardeningTests
• scripts/ci/check-repository
  • policy 0.2.83
  • 287 Python tests
  • Rust debug and release suites: 162 + 74 + 32 + 9 each
  • 7 documentation tests
  • independent two-root reproducible release build
  • final policy, capture-identity, source-membership, mode, and byte comparisons