fix(runtime): stabilize live admission boot path (#102)

fix(validator): add structured exec results and strict patchability outcomes

Merge remote-tracking branch 'origin/main' into codex/issue-79-81-20260308

Harden exploitability check expectations (#84)

fix(validator): harden evidence checks and fail unvalidated golden steps

Remove hardcoded fallbacks, add snapshot-driven service lifecycle

Add live admission for rendered child snapshots

Production all-in-one container with real service execution

Full OpenRange implementation: environment, builder, validator, agents, tests