[codex] Close P9-4 stable evidence gates

[iiwish]

Summary

• Fixes the stable surface checker fallback envelopes so success, ordinary failures, unsafe-output fallback, and top-level catch fallback share the same required JSON shape.
• Adds contract coverage for stable surface usage errors, including --bad-arg exit code, empty stderr, parseable JSON, diagnostic code, redaction, and full boundary fields.
• Refreshes repo-only P8-2 compatibility matrix evidence and adds P9-4 fresh main release-candidate evidence for origin/main.

Evidence

• Release target SHA: b159072bc2fead08b28c5ccd6fee62826a7522d3.
• Remote release-candidate run: 28433339705.
• Verified releaseTargetSha == origin/main == workflow headSha.
• Downloaded and normalized the five release-candidate artifacts, then ran npm run release:verify on the normalized directory.
• Final package-content equivalence for b159072bc2fead08b28c5ccd6fee62826a7522d3..HEAD: packageContentEqual: true, evidenceOnlyDrift: true, freshReleaseCandidateRequired: false.

Validation

• git diff --check
• npm run typecheck
• npm run lint
• npm run build
• npm run stable:surface:check
• node ./scripts/check-stable-surface.mjs --bad-arg
• npx vitest run tests/contract.test.ts --reporter=verbose --testNamePattern "stable surface|API schema contract|stable readiness|package root" --testTimeout 120000
• npm test
• npm run package:check
• npm run prepublish:check
• npm run release:package-content:verify -- --base-ref b159072bc2fead08b28c5ccd6fee62826a7522d3 --head-ref HEAD

No npm publish, no GitHub Release mutation, no npm token/trusted publishing setup, and no authenticated real agent run.