feat(network): implement passive replay integration - #11

Summary

• integrate network-aware record and passive replay validation for RFD 2 phase 3
• retain atomic, bounded, sanitized failure bundles across dependency, preflight, runtime, publication, and replay-validation failures
• isolate adapter-owned fixtures and classify QMP connection deadline exhaustion as a timeout
• add regressions for diagnostic coverage, unsafe log sources, redaction boundaries, output bounds, retained transitions/counts, and QMP timeout behavior
• document the implementation and fresh real-QEMU acceptance evidence

Review

Four Oracle review/fix rounds were completed. Findings addressed:

1. preflight and publication failures bypassed retained diagnostics; escaped paths and post-transform output could evade sanitization/bounds; QMP deadline exhaustion was classified as NotFound
2. runtime-creation reporting could read unvalidated logs; split-tail sanitization was ineffective; dependency initialization was outside failure context
3. newline-containing private paths could defeat line-based sanitization
4. final review: no findings remain

Validation

• make check-rfds
• .agents/dev cargo fmt --all -- --check
• .agents/dev cargo clippy --locked --workspace --all-targets --all-features -- --deny warnings
• .agents/dev cargo test --locked --workspace --all-targets --all-features (82 tests)
• bash -n .agents/dev .agents/setup scripts/*.sh
• nix --extra-experimental-features 'nix-command flakes' flake check
• .agents/dev ./scripts/phase4-acceptance.sh with QEMU 11.1.0: record plus two byte-identical passive replays; artifact and VM-identity tampering rejected with retained failure bundles