fix: integrate audit findings round 1 - tools, worker, scheduler, main agent

- Unify ToolResultEnvelope (output vs content) for built-in tools
- Fix shell.run AsyncGenerator consumption in ToolRegistry.call/streaming
- Scheduler: consume WorkerResult.status instead of marking all running tasks completed
- WorkerProcess/WorkerManager: surface exit events and generate failed/cancelled result
- MainAgent: integrate ContextAssembler, Chinese destructive regex, ArchitectureDesigner impact gate
- run.ts: pendingConfirmation flow, dispatch extracted, .air files filtered from /results
- CapabilityRegistry wired into RuntimeApp and ServiceRegistry; DoctorService uses it
- release.ts: findRepoRoot/findBun, run air e2e + depcruise + runtime regression
- New gates: release-critical-gates, CLI run command regression
- 14/14 e2e gates pass; 3/3 release dry-run pass

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

packages/cli/test/run-command-regression.test.ts

@@ -0,0 +1,24 @@
+import { describe, it, expect } from 'bun:test'
+import { readFileSync } from 'fs'
+import { join } from 'path'
+
+describe('run command result presentation', () => {
+  const source = readFileSync(join(import.meta.dir, '../src/commands/run.ts'), 'utf-8')
+
+  it('prefers WorkerResult.changed_files over recent filesystem scan', () => {
+    expect(source).toContain('get_result_for_task')
+    expect(source).toContain('workerResult?.changed_files')
+  })
+
+  it('filters .air internals from produced files', () => {
+    expect(source).toContain("file.startsWith('.air/')")
+    expect(source).toContain("e.startsWith('.')")
+  })
+
+  it('routes destructive confirmation before slash/main dispatch', () => {
+    expect(source).toContain('pendingConfirmation')
+    expect(source).toContain('handle_confirmation(true)')
+    expect(source).toContain('handle_confirmation(false)')
+    expect(source).toContain('No task was created')
+  })
+})