T19-01 Phase 4: Authenticated canary and contingencies

[edithatogo]

Track phase issue governed by the T19-01 Conductor plan.

Parent track: #550
Parent phase: #554
Plan: conductor/tracks/T19-01/plan.md

Implementation is not authorized by planning-only track creation.

• Add a disposable unpublished canary with no-email and no-publication invariants.
• Detect runtime Tiptap errors, mounted schema fingerprints, DOM duplication, page closure and cleanup state.
• Add stop conditions for auth expiry, CAPTCHA/2FA, shared cooldown, schema drift and cleanup failure.
• Document CLI-only update-in-place and selective normalization as explicit contingencies.
• Phase Verification & Checkpoint (see conductor/workflow.md).

[edithatogo]

Season 1 evidence update: the authenticated canary must verify editor mount after write, not merely GET 200 or valid draft_body. ME-002 has a 46,028-byte valid body yet appears empty after Tiptap rejects tableHeader. See the audit comment on #550.

[edithatogo]

Completed via PR #601. Table normalization contingency implemented (converting tableHeader to accessible labelled lists) and disposable canary verification harness created.