feat(factory): add safe Kit failure diagnostics

[walker-tx]

Summary

• project validated Kit child lifecycle events into a strict, capped diagnostics schema
• build deterministic failure manifests without retaining prompts, commands, URLs, results, credentials, IDs, or arbitrary errors
• preserve primary failure statuses, fail closed on malformed marked input, and upload only validated failed-run diagnostics for seven days
• harden workflow contracts and stale-artifact cleanup with adversarial regressions

Testing

• GOFLAGS='-ldflags=-linkmode=external' bash factory/tests/run.sh (13/13)
• mise x shellcheck@0.10.0 -- shellcheck factory/scripts/.sh factory/tests/.sh
• mise x actionlint@1.7.7 shellcheck@0.10.0 -- actionlint .github/workflows/guide-draft.yml
• git diff --check

Security

Diagnostics contain only validated lifecycle metadata. Raw prompts, commands, URLs, tool arguments/results, credentials, environment values, session/call IDs, transcripts, summaries, and arbitrary errors are never retained or uploaded.