Harden hosted run-scope lookup against HTML error pages

[jeffskafi]

Implements AUG-335 for AUG-333. Parent issue merges this.

Base 4b97519caf3fcf5e9cc23e71fc7920266f9eaa34 (main). Head ff1689d39ae93ea562c0582c68dc8f170328ce32.

What changed

• Synthetic and v2 bindings return before getRunExecutionScope, so they never request a scope. Authorized packets that still have no scope keep INVALID_EXECUTION_SCOPE.
• assertHostedScopeUsable holds the shared post-fetch checks (release capability, workspace, availability, authority verification, scope and authority expiry, target boundary). The pinned path still compares revision and hash. Run lookup skips only those two comparisons.
• getRunExecutionScope returns undefined only for HTTP 404. Other failures, including 5xx CLOUD_REQUEST_FAILED, propagate.
• #request no longer turns a non-JSON error page into INVALID_CLOUD_RESPONSE. Non-2xx non-JSON bodies continue through the existing status handling with no body, and the message names the method and path. Non-JSON 2xx bodies still throw INVALID_CLOUD_RESPONSE. Billing HTML error bodies are unchanged.
• Stub fallbacks that model an unimplemented route now return the production HTML 404 page.

Tests added

• test/cloud/request-errors.test.ts: HTML 404 keeps http_status: 404; HTML 200 is INVALID_CLOUD_RESPONSE; a billing HTML error body stays INVALID_CLOUD_RESPONSE.
• test/real-data/contract.test.ts: synthetic and v2 bindings make no scope request; a looked-up scope that passes the shared checks is used; each failed check is rejected with that check's code; an HTML 404 lookup is INVALID_EXECUTION_SCOPE; a 503 lookup propagates; a stale pinned revision is still rejected before availability.
• test/recovery/recovery.test.ts: recover --resume for a synthetic run completes against an HTML 404 fallback.
• test/selection/execution.test.ts: a saved v2 suite run completes against an HTML 404 fallback.
• test/investigation/admission.test.ts: an investigation rerun completes against an HTML 404 fallback.

Verification

• npm run check passed (1092 tests passed, 1 skipped).
• npm run smoke:pack passed.
• npm run test:packed-core-release:local passed. Local releaseReady stays false because registry identity and the live-authorized environment are not run; every executed check passed.
• node scripts/packed-saved-suite-release.mjs passed.
• node scripts/packed-real-data-privacy.mjs passed.
• node scripts/packed-report-fixture.mjs passed with AUGMENTWORKS_PACKED_BIN pointed at the built CLI (the script requires that variable; smoke:pack invokes it the same way).

Linear Issue: AUG-335