test(tui): restore full Linux workspace gate after main updates

[aboimpinto]

Summary

Restore the full Linux libtest gate on upstream main@2d9613bac0da38464f8fd700788e2a1dffc220c0 without changing product behavior or disabling tests.

• The uncatalogued route-budget test now holds the test environment lock and clears both output-cap overrides while asserting the automatic ceiling. Neighboring tests set those process-wide variables.
• The approval-heartbeat test now uses the existing approval-timeout test guard with no timeout. Another test sets the process-wide override to 25 ms; under full-suite concurrency, the heartbeat fixture observed deliver_external_approval == false before it could check event ordering. The guard makes the pending-decision state explicit.
• The managed-policy override test now supplies an immutable host-environment snapshot directly to discovery. Its prior process-wide environment mutation could change unrelated plugin tests that captured the environment concurrently.
• The MCP operator-proxy success path has a 10 s fixture request watchdog rather than a 2 s scheduler bound. It still asserts that the reviewed/model-added request cannot use the ambient proxy and that the operator-configured request reaches the listener.

A PDF adapter test also failed during the initial investigation. Later diagnostics found /tmp at 100% inode use, with temporary SQLite creation errors across many tests. After removing stale generated codewhale-tui-test-state-* directories, the PDF test passed in both completed full-gate runs without a source change. The final runs had ample free inodes. This environment failure is recorded separately from the four fixture changes.

Issue #6665 acceptance criteria

1. Exact full-workspace gate, all five named tests executed: Met locally twice. sh scripts/with-hermetic-test-home.sh cargo test --workspace --all-features --locked -- --format=pretty exited 0 on two successive runs of this branch. Each run reports TUI 13,456 passed; 0 failed; 19 ignored, and all five issue identities have ... ok lines. Initial clean-main run: 13,453 passed; 3 failed; 19 ignored; later clean-main repeat: 13,450 passed; 6 failed; 19 ignored. No affected test was disabled or ignored.
2. Diagnose repaired causes and record before/after: Met for the changes above. The approval diagnostic recorded approval delivery: false in the full suite and stale after decision: [] when selected alone. Plugin and route tests read process-global state; the MCP success case tested a scheduling bound unrelated to proxy safety. The PDF result is classified as environment capacity based on the inode measurement and SQLite errors; no PDF code was changed. The earlier failing runs and both green full runs are preserved locally.
3. CI-style nextest: Met locally. sh scripts/with-hermetic-test-home.sh cargo nextest run --workspace --all-features --locked --profile ci reports 16,753 passed; 27 skipped.
4. Formatting, Clippy, remote CI: Local cargo fmt --all -- --check and the exact CI-policy Clippy command passed. Remote CI is pending and must be reviewed before merge.

The logs and approval stage receipts are saved in the workspace FEAT-029 diagnostic directory, evidence/postmerge-2026-09-27/ (including origin-main-full-workspace.log, origin-main-full-workspace-after-inode-cleanup.log, approval-full-suite-stage.txt, upstream-fix-full-workspace-verified-04.log, upstream-fix-full-workspace-repeat-05.log, upstream-fix-nextest-01.log, and upstream-fix-clippy-01.log). These local diagnostic files are not part of this PR.

Closes #6665

Paulo Aboim Pinto