Harden hosted environment resolution and reporting

[hadarishav]

Summary

• resolve and persist one deterministic environment plan across preflight, bundles, and provisioning
• enforce source, runtime, dependency ownership, secret-reference, and cleanup invariants
• propagate typed actionable environment failures instead of generic exit codes
• add bounded stage heartbeats with progress details
• keep call lifecycle separate from grading coverage and report actual conversation duration
• fix mid-run scenario count adjustments for written numbers

Validation

• Ruff passed
• 384 harness tests passed; 10 opt-in tests skipped
• git diff check passed

Scope

This PR intentionally targets the existing hosted harness working branch. No credential files, generated artifacts, or external test-checkout changes are included.