fix(benchmark): bound and diagnose native receiver startup - #8214

Native receiver preflight used to erase every failure into native_receiver_unavailable. A disconnected observer therefore aborted startup without identifying whether initialization, account read, or rate-limit read failed. Its initialization timeout also started after process creation, allowing slow spawning to escape the intended total observation window.

This change retains bounded local stage, error-category, attempt and elapsed-time diagnostics. It retries only the shared transport's exact disconnect/timeout codes, using at most three fresh disposable observers within the original 25-second IO window. Rejected RPCs, invalid accounts, local setup failures and unknown errors remain fail-closed. A remote error message that impersonates a timeout code cannot trigger retries.

The existing native reader accepts an optional monotonic deadline and checks it before spawning, after spawning, and before its initialized notification. Existing checkpoint readers that omit the option retain their relative-timeout behavior. Account reads still use refreshToken=false; no model request, credential refresh, session reset or solver-budget extension is added. Process cleanup may finish after the IO deadline.

Example synthetic failure output retains ok=false, code=native_receiver_unavailable and inference_invoked=false, with an attempt such as stage=account_read, error_kind=protocol_rejected. Raw exception text, native stderr, account identities and RPC bodies are never projected.

Validation on the final head:

• Linux with the real SForge SDK: 22 tests pass, including all three generated startup commands, actual synthetic stdio subprocesses, successful retry after disconnect, three-attempt cap, forged remote timeout rejection, unchanged source profile and absent phase/scheduler writes on failure.
• macOS: 19 readiness tests pass; three SDK-dependent checks skip because that SDK is absent there. The same three checks pass on Linux. Two separate optional real-native-binary checkpoint checks remain skipped; their explicit binary was not configured.
• Existing checkpoint pagination, missing/foreign history, cursor and sealed-prefix compatibility checks: 26 pass.
• Spawn-expiry and initialization-expiry counterexamples now prevent later native IO; cleanup/backoff and home preparation consume the same absolute window. Independent review is tracked separately.
• Exact-head quick premerge: every direct and selected validation check passes (zero failures). Its overall result is manual_review_required solely because benchmark-sensitive changes require maintainer review; no merge is performed. An initial attempt lacked the TypeScript development dependency; the environment was installed without changing source or thresholds.
• Actual SForge SDK installation into a new network-disconnected container: the final native-Goal frozen source imports without site packages, and the generated startup command correctly rejects initialization/account/rate-limit failures and passes a successful read. The success case uses a pre-expired execution deadline so no scheduler or model starts. Source and trial profiles are byte-identical before/after, disposable homes are removed, and model calls are zero. This uses a synthetic native stdio process, not a real account or a model service.

This is a bounded receiver-transport fix in the existing owner, with a small compatible deadline extension to its shared reader. The diagnostic categories remain local to this CLI; they do not create Goal states or a recovery/admission owner. This PR targets the integration branch that already contains receiver preflight. It changes no UI, scoring, evaluator feedback, active run or global account selection. A failed pre-execution trial without a session/checkpoint still requires an explicitly authorized cold replacement; this patch does not make it a warm recovery. No model adoption, benchmark-score improvement, or recovery of the original unclassified failure is claimed.

Main delivery

The receiver startup change and tests are carried by the main-target proposal #8262. This integration PR preserves its original review and source history.