feat(wake): W5 — synthetic-canary FN-oracle + source-parity reconciler

Adds A6 (fn-oracle.sh) and A7 (reconcile.sh) of the wake/heartbeat canon
(EPIC #892, W5), building on merged W2/W3/W4 via their public APIs only
(store.sh/ack.sh/detector.sh untouched).

A6 fn-oracle.sh — synthetic-canary FN-oracle (§4 vector: FN-rate=0; §7 res5).
  Injects a KNOWN delta at the SOURCE boundary, drives the pipeline through the
  detector's public poll-once (a black box), and renders its verdict SOLELY from
  the terminal store cursor (did a CONSUMED ack cover the canary's observed_seq
  within the per-class SLO?). Off-domain / detector-independent: it never reads a
  detector hash-file or self-report, so a detector that silently DROPS changes —
  including a fully-disabled one at a perfect 0-wake rate — FAILS the oracle
  (the §4/A8 false-negative-blindspot killer). Runs in its own isolated XDG
  namespace, never the operator's live queue. No invented SLO (design law):
  --slo-seconds is required.

A7 reconcile.sh — source-parity reconciler (§4/G3).
  (i) source-coverage PARITY INVENTORY first: a declared source not covered by
      any watch, a dangling reference, an empty lane, or a required_sources
      omission FLAGS — an omitted source cannot make the §4 vector pass
      vacuously (not silently green).
  (ii) periodic full reconcile: enumerate each covered source's current state vs
      observed_seq/inbox => 0 unaccounted; any gap FLAGS. Handles the W4-ratified
      division (detector first-seen-baseline does NOT wake) by ENUMERATING
      pre-existing/startup state into the durable store; inbox-reflected state is
      accounted (no double-enumeration). Fail-loud (G2a) on adapter error.

RED-FIRST tests (wired into test:framework-shell), shellcheck clean:
  test-wake-fn-oracle.sh   O1 healthy FN-rate=0; O2 disabled detector -> FN-DETECTED
    at perfect no-op; O3 CONSUMED-but-late -> FN; O4 off-domain verdict; O5 SLO required.
  test-wake-reconcile.sh   R1 complete inventory; R2 omitted-source vacuous-pass
    prevented; R3 required_sources omission; R4 dangling; R5/R6 pre-existing ->
    flagged + enumerated -> re-run 0; R7 inbox-accounted no-double; R8 G2a fail-loud.

manifest.txt version 0.3.0 -> 0.4.0 + inventory (schema range untouched).
Operator-agnostic (XDG/env only; no operator paths/names/hosts/secrets).

Part of #892

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0158NZqN2n2ymKFeJAZ4GUCb

packages/mosaic/framework/tools/wake/manifest.txt

@@ -14,8 +14,9 @@
 #   0.1.0  W2 — store+drain lib + ack-wrapper.
 #   0.2.0  W3 — cumulative-state digest renderer + non-circular HMAC signer.
 #   0.3.0  W4 — per-host single-instance delta-gated detector daemon.
+#   0.4.0  W5 — synthetic-canary FN-oracle + source-parity reconciler.
 component=wake
-version=0.3.0
+version=0.4.0
 
 # Watch-list schema this component consumes, and the INCLUSIVE range of
 # schema_version values it supports. A wake-watch-list.json whose schema_version
@@ -35,5 +36,13 @@ schema_max=1
 #   detector.sh A1 — per-host single-instance delta-gated detector daemon
 #                    (flock, anchor-scoped hashing, detector-local observed_seq,
 #                    fail-loud source semantics; enqueues deltas to store.sh). (W4)
-# Out of scope (later waves): FN-oracle/reconciler (W5), beacon (W6),
-# installer (W7).
+#   fn-oracle.sh A6 — synthetic-canary FN-oracle: injects a KNOWN delta at the
+#                    source boundary, drives the pipeline through the detector's
+#                    public poll-once, asserts CONSUMED within the per-class SLO
+#                    (off-domain verdict from the terminal store cursor). §4
+#                    requires FN-rate=0; a dropping/disabled detector FAILS.  (W5)
+#   reconcile.sh A7 — source-parity reconciler: (i) source-coverage parity
+#                    inventory (an omitted source cannot pass the vector
+#                    vacuously) + (ii) periodic full reconcile to 0-unaccounted,
+#                    enumerating pre-existing/startup state into the store.   (W5)
+# Out of scope (later waves): off-host beacon (W6), installer (W7).