Extend the hermetic gate to the test runtime (flake-soundness precondition)

[ronimoe]

Context

P2 flake-soundness assumes the tests run hermetically (frozen clock, no network, fixed seed, bounded concurrency, pinned runner image). Today only lockfile resolution is gated. Without this the masking window reopens.

Scope

• A hermetic test harness + a CI drift probe (re-run a known prefix twice, diff).
• Wire into the verdict seam.

Acceptance

A deliberately non-hermetic test is flagged; the probe catches runtime drift.

Seam

tools/hermetic/, tools/conductor/verdict.py; DESIGN.md §9/§6.5.

[ronimoe]

Process layer implemented in ddd23b3.

hermetic_test.py freezes the test runtime the engine can control from the process side (clock/TZ, locale, PYTHONHASHSEED, a fixed seed) and adds a drift probe — run a known command twice under the frozen env and diff; non-identical output means the runtime is not hermetic, so the verdict fails closed. Unit-tested (deterministic vs random command).

Remaining for full close: the runner-layer freeze — pin the runner image by digest and deny network during the test step. The conductor-ci.yml template uses ubuntu-latest (not network-isolated); the probe is the empirical backstop, not a substitute. Per-test (not just suite-level) granularity via a test-report parser is a follow-up.