fix(wake): #920 quarantine render-refused drain entry (no head-of-line block) + reconciler enumerations render orientation-tier

Live pilot finding #6 (BLOCKING): a reconciler enumeration enqueued
class=actionable with soft locators {kind,id,path,observed_hash} failed
§2.1's ACTIONABLE hard-locator taxonomy, so digest render exit-4'd the
ENTIRE cumulative-state drain — 4 consecutive timer failures, NOTHING
delivered, including clean unrelated entries (head-of-line blocking).

FIX 1 (quarantine, don't wedge): digest.sh cmd_render's fail-loud pass is
now PER-ENTRY. A render-refused ACTIONABLE entry (no hard locator) is
DEAD-LETTERED to $STATE_DIR/dead-letter.jsonl + a loud per-entry alarm and
EXCLUDED, while the REST of the cumulative set still renders (exit 0). The
bad entry is accounted-for, never silently dropped; one malformed entry can
no longer wedge the whole drain.

FIX 2 (AMENDED — render-tier, NOT class=digest): reconcile.sh's store class
is UNCHANGED (non-coalescing) — the naive class=digest was rejected because
store §2.3/T2 coalescing would silently collapse distinct enumerations
(proven: reconcile R6 goes RED). Instead digest.sh's actionable-classifier
now treats locators.reconciled==true (set only by reconcile.sh; not
source-forgeable) as ORIENTATION-tier: gate-exempt, rendered as an
orientation pointer via _locator_line's digest-class vocabulary. No exit-4,
no wedge, no coalescing loss; §2.3/T2/G3-R6 intact.

RED-FIRST: new test-wake-digest-quarantine.sh (openssl-independent) proves
(a) malformed {kind,id,path,observed_hash} quarantines while a clean sibling
still delivers, (b) a reconciled enumeration renders orientation-tier (no
exit-4), (c) TWO distinct enumerations both survive as separate orientation
renders (anti-collapse — the class=digest silent-drop we rejected), and the
preserved per-entry actionable fail-loud. D2/D6 in test-wake-digest-hmac.sh
updated from whole-digest exit-4 to per-entry quarantine. Wake manifest
bumped 0.6.2 -> 0.6.3 + inventory.

Closes #920
Part of #892

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0158NZqN2n2ymKFeJAZ4GUCb

packages/mosaic/package.json

@@ -25,7 +25,7 @@
     "lint": "eslint src",
     "typecheck": "tsc --noEmit",
     "test": "vitest run --passWithNoTests && pnpm run test:framework-shell",
-    "test:framework-shell": "python3 src/lease-broker/daemon_deadline_unittest.py && python3 src/lease-broker/normative_fragments_unittest.py && python3 src/lease-broker/receipt_challenge_unittest.py && python3 src/lease-broker/context_recovery_unittest.py && python3 src/lease-broker/recovery_runtime_unittest.py && python3 src/lease-broker/recovery_b1_adversarial_unittest.py && python3 src/lease-broker/framework_skill_portability_unittest.py && python3 src/mutator-gate/runtime_tools_unittest.py && python3 src/mutator-gate/runtime_launch_guard_unittest.py && python3 src/mutator-gate/version_coupling_unittest.py && python3 framework/tools/lease-broker/check-runtime-launches.py --root ../.. && bash framework/tools/codex/test-pr-diff-context.sh && bash framework/tools/qa/test-deps-preflight.sh && bash framework/tools/git/test-pr-review-gitea-comment.sh && bash framework/tools/git/test-pr-review-repo-host-override.sh && bash framework/tools/git/test-ci-queue-wait-branch-absent.sh && bash framework/tools/git/test-git-credential-mosaic.sh && bash framework/tools/git/test-gitea-token-identity.sh && bash framework/tools/_scripts/test-install-ordering-guard.sh && bash framework/tools/tmux/agent-send.test.sh && bash framework/tools/wake/test-wake-store-ack.sh && bash framework/tools/wake/test-wake-digest-hmac.sh && bash framework/tools/wake/test-wake-detector.sh && bash framework/tools/wake/test-wake-fn-oracle.sh && bash framework/tools/wake/test-wake-reconcile.sh && bash framework/tools/wake/test-wake-beacon.sh && bash framework/tools/wake/test-wake-install.sh"
+    "test:framework-shell": "python3 src/lease-broker/daemon_deadline_unittest.py && python3 src/lease-broker/normative_fragments_unittest.py && python3 src/lease-broker/receipt_challenge_unittest.py && python3 src/lease-broker/context_recovery_unittest.py && python3 src/lease-broker/recovery_runtime_unittest.py && python3 src/lease-broker/recovery_b1_adversarial_unittest.py && python3 src/lease-broker/framework_skill_portability_unittest.py && python3 src/mutator-gate/runtime_tools_unittest.py && python3 src/mutator-gate/runtime_launch_guard_unittest.py && python3 src/mutator-gate/version_coupling_unittest.py && python3 framework/tools/lease-broker/check-runtime-launches.py --root ../.. && bash framework/tools/codex/test-pr-diff-context.sh && bash framework/tools/qa/test-deps-preflight.sh && bash framework/tools/git/test-pr-review-gitea-comment.sh && bash framework/tools/git/test-pr-review-repo-host-override.sh && bash framework/tools/git/test-ci-queue-wait-branch-absent.sh && bash framework/tools/git/test-git-credential-mosaic.sh && bash framework/tools/git/test-gitea-token-identity.sh && bash framework/tools/_scripts/test-install-ordering-guard.sh && bash framework/tools/tmux/agent-send.test.sh && bash framework/tools/wake/test-wake-store-ack.sh && bash framework/tools/wake/test-wake-digest-hmac.sh && bash framework/tools/wake/test-wake-digest-quarantine.sh && bash framework/tools/wake/test-wake-detector.sh && bash framework/tools/wake/test-wake-fn-oracle.sh && bash framework/tools/wake/test-wake-reconcile.sh && bash framework/tools/wake/test-wake-beacon.sh && bash framework/tools/wake/test-wake-install.sh"
   },
   "dependencies": {
     "@mosaicstack/brain": "workspace:*",