[guard.dirac.ρ.D8+] Close registry and CI ratchets for the research loop

The research-loop surface had already become public and introduced a command-level stale-preview refusal, but its public golden and exact DB-enum subset test still described the pre-loop world. Review those six commands at their introducing commit, name STALE_PREVIEW in the intentional non-Job error set, and move the facade byte guard by the measured 403-byte mount-only integration while retaining the 1,200-line ownership boundary. This makes the contract gates judge the architecture that actually shipped rather than failing on stale controls.

Author: ivanicu

backend/tests/test_envelope.py

@@ -132,7 +132,7 @@ def test_db_enum_is_a_subset_of_the_error_vocabulary():
 
 def test_the_reverse_does_not_hold_and_the_gap_is_exactly_named_codes():
     """The direction that must NOT hold, asserted exactly — not 'at least
-    these two', but EXACTLY these two, so that the day a THIRD code appears
+    these codes', but EXACTLY these codes, so that the day another code appears
     in errors.json but not the enum, this test fails and someone has to look
     at it rather than let a silent third case join the two legitimate ones.
 
@@ -146,7 +146,7 @@ def test_the_reverse_does_not_hold_and_the_gap_is_exactly_named_codes():
     assert only_in_vocabulary == {
         'BAD_HOST', 'OPEN_SHELL_SPIN_REQUIRED', 'NOT_FOUND', 'DB_UNAVAILABLE',
         'AUTH_REQUIRED', 'FORBIDDEN', 'RATE_LIMITED', 'QUOTA_EXCEEDED',
-        'TLS_REQUIRED', 'IDEMPOTENCY_CONFLICT'}, (
+        'TLS_REQUIRED', 'IDEMPOTENCY_CONFLICT', 'STALE_PREVIEW'}, (
         f'the errors.json-minus-enum set difference moved to '
         f'{sorted(only_in_vocabulary)} — re-read db_enum_note in errors.json '
         f'and update either the note, the enum, or this test, deliberately')

contracts/golden/public-registry-v2.json

@@ -1,7 +1,8 @@
 {
   "schema_version": "1.0",
-  "reviewed_repository_commit": "7a480bd8a8c8aa3d48837d5a50663a1140fdb41e",
+  "reviewed_repository_commit": "2675f228f718f1a0f7c319c958e13c14d38d43c8",
   "commands": [
+    "ai.provider.list",
     "attention.list",
     "campaign.bayesian-rank",
     "campaign.closed-loop.get",
@@ -78,6 +79,11 @@
     "program.work_package.record",
     "proposal.generate",
     "protocol.version.record",
+    "research.loop.approve",
+    "research.loop.control",
+    "research.loop.create",
+    "research.loop.get",
+    "research.loop.reject",
     "result.ingest",
     "sample.create",
     "sample.transfer",