fix: address HIGH and MEDIUM findings from the #19 reviews

[datj9]

Fixes every finding from the two reviews on #19. Stacked on feat/delegation-scope, so merging this lands them in #19.

HIGH (3)

Finding	Fix
Escalation fired on a cancelled job — maybe_escalate gated on delegation_verdict != "failed", but that returns "failed" for any non-SUCCEEDED terminal, so crossagent cancel silently re-dispatched the task to a larger, costlier advisor	escalate.py now gates on SUCCEEDED first: only a declared gate failure (check/scope/verify) escalates
tempfile.mkstemp() outside its own try broke the documented "never raises" contract. On a read-only /tmp or full disk the OSError escaped into worker_main after the check and scope ran but before the terminal record was persisted — job wedged non-terminal forever, completed work discarded	verify.py extracts a _schema_file() context manager with setup in its own try/except; failure degrades to an error outcome. Same OSError hardening applied to escalate.py
Credential scrubbing missed the default path — cli.py's _run_advisor called runner.run(...) with no env=, so crossagent --agent … --prompt … handed the advisor the full unscrubbed environment, with no --pass-env escape hatch on that path	cli.py now passes a scrubbed env=, sharing one policy with the job path

TIMED_OUT was decided deliberately, not inherited. CANCELLED is unambiguous — explicit user intent, never escalate. TIMED_OUT cut both ways; the call was do not escalate, because a timeout yields no gate verdict and a larger model is typically slower, so escalating tends to burn budget timing out again. Reasoning is in-code at escalate.py:122-133 so a future reader can disagree with the decision rather than rediscover the behaviour.

MEDIUM (4)

• Forbidden placeholder names obj and info renamed.
• run_verification 71 → under 50 lines (_interpret_run_outcome extracted).
• maybe_escalate 135 → 94 lines (eligibility guard, child-Job build, and disk staging extracted). Still above the 50-line guideline — see Known gaps.
• New dependency-free types.py holds the shared gate-result shapes; jobs.py 1061 → 985. The review suggested moving these into scope.py/verify.py, but those already import both the types and Job from jobs.py, so that direction creates a circular import — a neutral module is the clean route and it also removes the awkward back-import.

Verification

• 513 passed, ruff check and format --check green.
• The HIGH regression tests were confirmed genuine: reverting only the three source files to their pre-fix state while keeping the new tests makes 6 tests fail. A test written after a fix that passes either way documents behaviour without proving the bug is gone.
• The MEDIUM work is a pure refactor: the test suite is byte-for-byte unchanged and still at 513. Had a test needed editing to accommodate the refactor, that would have meant behaviour changed, not code tidied.

Known gaps (deliberate)

• maybe_escalate is still 94 lines. Further splitting would have produced helpers with long parameter lists called once — worse than a linear function that reads cleanly.
• jobs.py (985) and cli.py (1021) remain over the 800-line guideline. Both predate this work; decomposing them is out of scope for a fix PR on a branch already under review.
• The two security findings from the audit on feat(security): diff-scope assertion and credential withholding for delegates #19 — .git/hooks/* writes and out-of-repo writes both reporting scope ok — are not addressed here. They are gaps in enumeration rather than defects in the matcher, and warrant their own change.