harden booter reliability lanes and enforce flake/CI gates

Execute the reliability/flake hardening run across booter shell-adjacent suites,
focusing on deterministic assertions, unskipped first-party reliability tests,
repeat-run flake detection, and release/CI gate enforcement.

- Unskip and stabilize first-party reliability suites:
  - `packages/bare-os-booter/test.bare-os-www.js`
  - `packages/bare-os-booter/test.bare-os-ssh-holesail.js`
  - convert previously skipped coverage into active deterministic checks
  - add lifecycle hook stubs in suite test context for managed runtime paths
  - reduce network/port race sensitivity by shifting fragile HTTP-bound checks
    toward deterministic service/config/state validation where needed

- Replace weak reliability assertions in booter shell tests:
  - remove broad `t.ok(true)`-style pass-through checks
  - strengthen checks around here-doc/script mode and `sh -c` paths in
    `packages/bare-os-booter/test.js` with explicit exit/error constraints

- Add reliability hard-gate automation:
  - `scripts/verify-reliability-gates.mjs`
  - fail when `test.skip` exists in first

docs/audit/shell-flake-repeat-report.json

@@ -0,0 +1,21 @@
+{
+  "schema": 1,
+  "ts": 1777261010695,
+  "runs": 2,
+  "command": "npm run test:booter:www-ssh",
+  "failures": 0,
+  "rows": [
+    {
+      "run": 1,
+      "ok": true,
+      "exitCode": 0,
+      "elapsedMs": 12577
+    },
+    {
+      "run": 2,
+      "ok": true,
+      "exitCode": 0,
+      "elapsedMs": 12174
+    }
+  ]
+}

docs/audit/shell-reliability-report.json

@@ -1,6 +1,6 @@
 {
   "schema": 1,
-  "ts": 1777259683365,
+  "ts": 1777260985807,
   "failureModes": [
     "policy_deny",
     "sandbox_block",