feat(cli): expose runtime JSONL observations and minimal device defaults

[jamesboyzj-design]

Scope

Draft for review of the CLI runtime JSONL observation contract and minimal device defaults. This branch is synchronized with current main. The certificate fix from #264 and its strict X509 regression coverage are already in main; this PR contains only the remaining CLI/runtime feature changes. It contains no Agent Workbench wrapper, product data or dependency bump.

Changes

• run --events-jsonl PATH: private, exclusive, versioned JSONL file, kept separate from child output and outside sandbox writable/mounted trees.
• Export existing policy_fn observations and RunResult.changes. Never label a non-denied supervisor observation as kernel success, or a COW change set as a commit receipt. Omit argv, environment, file content and credentials.
• Sequence and terminal records, timeout distinction, bounded output file, explicit failure for incomplete/unrepresentable observations. No-supervisor mode rejects this flag.
• CLI minimal device defaults: null read/write; zero/random/urandom read-only. Validate character-device type and major/minor, reject replaced nodes. --no-default-devices opts out; library callers explicitly opt in via .standard_devices()? without changing the library's default policy.

Validation

Before synchronizing with current main, the Linux ARM64 run reported 113 CLI tests passed and 842 core unit tests passed with two known root-environment COW failures (rename_staging_failure_fails_rename_and_rolls_back and write_open_in_unreadable_dir_virtualizes). The old CLI strict TLS test was included in that historical CLI count; it has since been removed because #264 moved this regression coverage into sandlock-core. These figures do not describe validation of the current synchronized head.

CI for the synchronized head is running: https://github.com/multikernel/sandlock/actions/runs/37090872119

Boundaries

policy_fn observations are not final kernel return values and may incur tracking/freezing overhead. supervisor_denied reflects an errno action, not proof that every such error is a security denial. The core does not expose that final errno through this callback. SIGKILL or host failure can leave an incomplete stream; there is no exactly-once replay or cryptographic sealing. No x86_64 VM or workload-capacity benchmark was run in the earlier validation.

[jamesboyzj-design]

Synced this branch with current main and resolved the TLS conflict by taking the certificate fix and core-level strict X509 coverage now present on main. I also removed the obsolete CLI strict-TLS test so this PR no longer duplicates #264 coverage, and updated the validation notes accordingly.

The remaining diff is the CLI runtime JSONL observation feature, minimal standard-device defaults, and their tests/docs. The synchronized head is c8a269d; all 17 CI checks pass, and GitHub reports the PR as mergeable with a clean merge state.