Topology-first enforcement reset (021) + runner reason-code/coverage fix (022) - #4

Why

Repeated review cycles can grow a design by accumulating gates, checkpoints, and cross-session state around an assumed enforcement point that no revision rechecks. Issue #3 asks for a topology-first reset that forces the planning authority to re-establish where production behavior is actually controlled before expanding enforcement further.

This PR delivers that reset as workflow guidance (Feature 021), and, dogfooding the very discipline it adds, applies a topology retrace to a small real runtime attribution bug it surfaced (Feature 022).

Feature 021: topology-first reset (guidance, no new artifact)

Woven into the two existing review-loop skills, so it creates no new skill, agent, state, or board:

• dude-receiving-code-review gains the three reset triggers (a control-boundary concern surviving two review cycles; a revision adding a new gate/store/checkpoint/cross-session state; enforcement expanding across modules or workflow boundaries) and requires the planning authority's six-part topology check before the next revision. Evidence that a mechanism covers an otherwise-uncovered reachable path lets the revision proceed; it is a gate on evidence, not an automatic veto. Ordinary local fixes stay exempt.
• dude-reviewer-protocol requires the verdict to judge the revised design against that evidence, verify claims against current source and call sites, and admit new machinery only with a demonstrated reachable failure plus a covering acceptance test.

Two T021 static contract pins lock the prose; .github/ projections are regenerated from src/.

Feature 022: runner reason-code and coverage fix

Retracing the real call graph runHostAdapter -> exchange -> orphan -> finish (the single terminal "safety writer") exposed two narrow defects at the untrusted host boundary:

• An untrusted host exchange callback could throw an error whose arbitrary error.code became the runner's terminal halt reason. It is now restricted to a frozen runner-owned allow-list (supervisor-context-lost, challenge-response-invalid, exchange-context-lost); any other code falls back to the runner-owned default. Legitimate codes still pass through.
• The orphan fallback row omitted the target it orphaned. target is now added to both orphan() branches. It is a row field only, so the evidence-derived haltReport is unchanged and Feature 013's contract holds.

Coverage: a regression test proving an arbitrary error.code cannot leak, and an integration test driven through the real finish() writer asserting a runner-owned reason plus the orphaned target. The production path was reachable, so these are genuine tests rather than a fabricated fixture.

Notes for reviewers

• Both changes are additive. Full suite green (2265 pass / 0 fail, 4 pre-existing environment skips), dude-lint 0 warnings / 0 failures, src/ and .github/ projections byte-identical.
• The runner fix intentionally adds target only to orphan fallbacks, not the runner-refused pre-binding terminal (target may be unbound there). Each new contract pin and each new test was mutation-tested (revert the change, confirm the guard fails).
• A related but out-of-scope concern (the runner attribution/coverage work) was split into its own idea before Feature 022 defined it, per the issue's Non-Goals.

Fixes: #3