test: deterministic boundary fault-injection matrix for daemon HTTP and subprocess seams

[thymikee]

Part of #1412 (Track E — gate integrity). From external review: Track A deliberately excluded the daemon HTTP and subprocess boundaries — but they are this repo's riskiest seams. Both are already injectable (exec.ts is the single subprocess seam; the provider/transport seam from #1389 covers the runner side), so faults can be injected deterministically, no chaos randomness.

Deliverables

• An enumerated fault matrix — faults: timeout, cancellation mid-request, partial/malformed response, process death mid-request, lost response AFTER a mutation dispatched, filesystem failure on artifact write, optional-optimization failure (e.g. direct-iOS selector fast path errors) — crossed with representative command classes (mutation, read, artifact-producing, session-lifecycle). Completeness enforced satisfies-style over both axes, matching the guarantee-matrix idiom.
• Invariants asserted per cell:
  • no lease/session/claim leaks (inventory clean after recovery);
  • no unsafe mutation replay (a lost-response mutation is never silently re-dispatched);
  • typed error identity survives wrapping — code, hint, diagnosticId, logPath all present at the CLI surface;
  • best-effort probes degrade instead of failing the request;
  • deadlines stay bounded (no hang; assert against the injected budget).
• Runs deterministically in the unit/integration lanes (fake providers + injected transport), not on live devices.

Relationship

Complements, not duplicates: the ADR 0011 guarantee matrix owns semantic guarantees per dispatch path; the torture lane (#1416) owns interleavings; this owns boundary faults. Cells already proven by existing subprocess-stub tests get credited, not rewritten.

Acceptance

• Matrix completeness is a compile/test error, not a review convention.
• At least the lost-response-after-mutation and process-death rows exist for press/fill and open/close before this closes.