refactor: move Sum to the published HC terminal runtime - #331

Replace Sum’s legacy terminal transport with unmodified published Herdr Core 0.1.14, following the implementation plan for #330.

The readiness workaround stays entirely in Sum. Qualified Codex 0.166.0 launches use the native Tab submission template: working, blocked and unknown recipients defer; Idle sends use HC’s idle guard; an observed Done sends normally, with native Codex queueing covering a raced busy turn. This carries an explicit non-atomic Done tradeoff and requires application receipts before completion.

• Add typed HC transport, exact runtime/terminal authority, native event observation, launch receipts, durable delivery reconciliation and consumption retention.
• Preserve guarded preparation, service stop, cleanup, releases and generation ownership; retire executable Mesh/plugin transport paths.
• Add quarantined records-only restore and fail closed on legacy cutover without an enforceable old-writer/sender exclusion lease.
• Update procedures, help, site, dependency pins and behavioral verification. Excluded Grok Bot and shared factory files remain unchanged.

Related upstream PR herdrdev/herdr-core#30 was closed unmerged at the owner’s request. This PR requires no upstream changes.

Local verification at 4026244599c5f2e9e5d0cd9a6a2281fce9ecde6c:

• Canonical aggregate passed: Go tests, 113 Python tests, Astro typechecking/unit tests/build and route emission. Run 20261030T185820Z-f512d07f: 238 automated scenarios passed; 46 manual scenarios remain not run in that aggregate.
• Lint, dependency inventory freshness and feature-map audit passed. Changed verification policy received independent line-by-line review; the runner correctly leaves certifies: null rather than self-certifying a changed standard.
• The published-HC application canary passed at 8dae435; the final repair changes one browser-test expectation and its rebuilt runtime helper has the same SHA256 (55e7c9f344ea967830701a5d3ba36eec88916394f997bff85e1d20fc3af9143d). The canary confirmed core shutdown. It proves observer startup and one deferred answer delivered after a native Done event before any further helper call; input submission does not mark the answer applied.
• Four CLI comparison records have no missing evidence: three pass/pass saved-view preservation comparisons and a real poisoned-signer red/green comparison through the configured test task. The Git proof uses a declared targeted Go-test adapter and is separate from the full aggregate.
• Independent review validated all twelve original findings and five follow-up findings as resolved. Final repair-delta and browser-expectation reviews found no new primary defects; the test-coverage limitation below remains explicit.

Hosted CI passed on 4026244: canonical Linux verification and site build plus Playwright tests. The initial browser run exposed an old heading expectation; the one-line correction preserves every status, heading and navigation assertion. Pages deployment was skipped for the PR.

Review limitation: source inspection covers transient observer reconnect before foreground metadata arrives, but there is no dedicated socket-fixture test for that exact startup interleaving. Delayed metadata, identity rejection and post-readiness reconnect have separate coverage; no runtime defect was established.

Limits: the full HC application canary uses a scripted TUI, private Git destination and fake GitHub. Separate actual Codex probes qualify the stated Tab behavior; other harnesses remain unqualified. Local interactive browser access was unavailable before navigation; no local screenshot or visual comparison was produced. Hosted Playwright checks subsequently exercised the rendered routes. The external Claude ACP reviewer could not initialize; independent local adversarial review is separate. No production migration, installation activation, merge or deployment was performed.

Plan: docs/plans/2026-10-30-1045-refactor-hc-terminal-runtime-plan.md. Evidence boundaries and reproduction: docs/verification/issue-330.md.