Adopt region coverage and safe Markdown rendering.

[samuel-williams-shopify]

Update the lockfile to resolve bake-test-rust 0.3.0 and align the test workflow wording with source-region coverage. Raise socketry-markdown to 0.2.0 or newer to avoid the inline CRLF serialization panic when installing the updated context guide, and prepare bake-agent-context 0.3.1 for that runtime dependency.

Add deterministic filesystem failures and task-level error propagation tests so the new coverage gate exercises the real failure paths. Make path-containment invariants explicit where earlier validation guarantees them, and reuse the canonical context root while resolving files.

Validation:

• cargo fmt --all --check
• cargo clippy --workspace --all-targets --locked -- -D warnings
• cargo bake --locked test:coverage --all-targets true