fix(supervise): retain unassessed native child reports

[drewstone]

Problem

A recursive external child with Runtime tools is a managed node. When its assignment has no completion check (resolveDeliverable: () => null), the backend drops its terminal artifact and the finalizer has no checked result. The child finishes successfully but the parent's durable result is null.

Change

Retain the newest successfully completed harness artifact through the existing driver metadata port. A nested child without a check may return that evidence only when the checked finalizer produced no result. Its settlement has no quality verdict, and the existing parent await_event receipt explicitly labels it unassessed and supplies the observe_agent read. Accepted submit_result and checked finalizer boundaries remain intact. A checked descendant cannot confer its verdict on the child's raw report.

No authored profile or method workaround can recover the omitted own-harness output through the existing checked-only finalizer. This fixes the shared Runtime owner. Frozen registrations and running pursuits are unchanged. No deployment or release-cohort mutation is part of this PR.

Proof

• Causal regression through the public provider adapter and real authenticated MCP: a successful child report reopened as null before the fix.
• Five cells verify parent await_event/observe_agent reads, durable reopening, declared-check refusal, checked-descendant provenance, accepted submit_result, and native failure.
• 135 focused recursive/finalizer tests passed; 75 bridge, Router and new integration cases passed after the CI corrections (205 distinct source cases across seven files).
• All five cases passed through the packed Runtime public kernel export. The 0.290.1 tarball SHA256 is 92b31ee832672d37b2aa21fac47ac2cb642fe68718ff5fbd6317e02de517208f. Its production source is 6699988; the final two commits only change tests.
• Lint, build, source/example typechecks, package verification, API surface and regenerated docs/freshness passed.
• Two independent read-only source reviews found no blocker.

CI corrections

The first remote CI run identified two existing bridge assertions that still expected a successful child report to be null. They now assert the retained report and absent verdict. It also identified a deterministically reproducible Router test timing assumption inherited from current main. The separate test-only correction awaits the actual retry timer before aborting; Router production code and retry policy are unchanged. All 75 affected cases pass. All four final-head remote CI jobs passed: ci, official-optimizers, packed-cohort and agent-bench. Current-head approval is present and no inline findings remain.

Evidence is retained on GTR under /mnt/traces/frontier-qualification-20260930/runtime-unassessed-managed-child-report-20261001. This is an offline provider integration proof; activation and live fleet proof belong to the normal release and launch owners.

[tangletools]

✅ Auto-approved PR — 66999884

Blanket team auto-approval is intentional. The merge gates are CI and codex-p1.
No automated review runs on this PR. This approval rests on the rule above alone.

_{tangletools · auto-approval · reason: blanket_auto_approve · 2026-10-01T13:07:34Z}

[tangletools]

✅ Auto-approved PR — 5f75a9e2

Blanket team auto-approval is intentional. The merge gates are CI and codex-p1.
No automated review runs on this PR. This approval rests on the rule above alone.

_{tangletools · auto-approval · reason: blanket_auto_approve · 2026-10-01T13:24:34Z}