Complete engine architecture contracts

[ncode]

What changed

• make core-fact scheduling descriptor-driven: gate a resolver only when every declared output root is disabled, keep eager virtualization/SELinux behavior, and demand-load shared DMI/GCE work
• replace mutable discovery defaults and test hooks with clone-safe invocation-local defaults, direct cache I/O, and fixed external-fact limits
• remove unreachable partition, Windows OS/architecture, and Plan 9 networking helper paths
• add public contract, deterministic probe-count, descriptor-output, concurrent isolation, freshness, seam-gate, and platform cleanup coverage
• record the architecture contract and implementation tasks in OpenSpec and update the changelog

Why

The prior descriptor metadata described multiple gating classes that the executor did not honor, so fully disabled multi-output/shared resolvers still performed probe work. Discovery policy also depended on mutable package globals used by tests, and several test-only helper paths overstated the live production surface.

This change makes the catalog the executable scheduling contract, keeps ambient inputs local to each invocation, and removes false surface without changing the public Facts tree or CLI compatibility boundary.

Validation

• go test ./... — 2,413 tests
• go test -race . ./internal/engine ./internal/app — 2,266 tests
• go test -shuffle=on -count=5 . ./internal/engine ./internal/app — 9,386 tests
• go vet ./..., make build, git diff --check
• openspec validate complete-engine-architecture-contracts --strict
• cross-target dead-code analysis and compile-only engine checks for Darwin, Linux, Windows, FreeBSD, and Plan 9
• OpenCodeReview: 14 review units, zero comments
• nlab Debian full/race/build
• nlab focused native defaults/external/networking tests on Windows, FreeBSD, and Plan 9
• nlab release gates on FreeBSD, OmniOS/illumos, OpenBSD, NetBSD, DragonFly BSD, Plan 9, and Windows