feat(plane): runner contract with artifact delivery (task 3)

ai-service-plane task 3, Requirements 4.1-4.4 (with 2.2 and 2.3 honoured by the
exit-code contract):

- src/openultrasast/plane/runner.py: the ax-task-runner entrypoint. Reads the Task
  from AX_TASK_YAML and the bound Workspaces from AX_WORKSPACES_YAML (task-1 loaders),
  serves /healthz and /readyz on port 80 (AX_RUNNER_PORT; 0 picks a free port,
  AX_RUNNER_HTTP=0 disables it for unit tests), materialises each workspace at its
  bound path (spec.files verbatim; spec.git at <path>/<name>, exported from the
  OUSAST_CASE_CACHE checkout whose origin matches, else a shallow clone at the pin;
  a repo already present on a resumed volume is kept) and only then answers 200 on
  /readyz. Runs spec.command by importing openultrasast.plane.tasks.<name> with the
  remaining elements as argv; sets OUSAST_WORKSPACE_DIR from the first binding when
  the Task's env leaves it unset. A crash writes summary.json with status failed and
  the traceback. When OUSAST_ARTIFACT_URL is set, the whole OUSAST_OUTPUT_DIR is
  POSTed as an uncompressed tar (Content-Type application/x-tar, X-Ousast-Task,
  X-Ousast-Run) with three attempts and backoff; a failed delivery rewrites
  summary.json to failed and exits 2. Exit codes: done 0, failed 2, unfinished 3.
- plane/Dockerfile.runner: python:3.12-slim + git, `pip install .` (no extras), a
  shell wrapper at /usr/local/bin/ax-task-runner exec'ing the module; built and
  loaded into kind by ops/ax/up.sh, not by the tests.
- tests/test_plane_runner.py (+ tests/plane_stub_task.py registered as the task
  module): env contract on a files workspace, readyz 503 then 200, delivery to a
  local receiver with the headers and tar checked, delivery failure -> failed and
  exit 2 after three attempts, crash -> failed with traceback, exit codes per
  status, case-cache export at the pin, shallow-clone fallback, resume keeps the
  checkout.
- model/audit.py: SPEC_OWNED row for plane.runner; module-audit measurement
  regenerated (122 modules, no orphans, note kept).

Co-Authored-By: Claude Fable 5.1 <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo

tests/plane_stub_task.py

@@ -0,0 +1,39 @@
+"""A stub task module for the runner tests: records its contract, writes one artifact and ``summary.json``.
+
+Registered by the tests as ``openultrasast.plane.tasks.stub_task``; ``STUB_MODE`` picks the outcome
+(``done``, ``failed``, ``unfinished``, ``crash``, ``nosummary``, ``exit``).
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import urllib.request
+from pathlib import Path
+
+
+def main(argv: list[str]) -> None:
+    out = Path(os.environ["OUSAST_OUTPUT_DIR"])
+    out.mkdir(parents=True, exist_ok=True)
+    mode = os.environ.get("STUB_MODE", "done")
+    workspace = Path(os.environ["OUSAST_WORKSPACE_DIR"])
+    readyz: int | None = None
+    port = os.environ.get("AX_RUNNER_BOUND_PORT")
+    if port:
+        with urllib.request.urlopen(f"http://127.0.0.1:{port}/readyz", timeout=5) as response:
+            readyz = int(response.status)
+    record = {
+        "argv": argv,
+        "env": {k: v for k, v in os.environ.items() if k.startswith("OUSAST_")},
+        "workspace_files": sorted(p.relative_to(workspace).as_posix() for p in workspace.rglob("*") if p.is_file()),
+        "readyz": readyz,
+    }
+    (out / "facts.json").write_text(json.dumps(record, indent=2, sort_keys=True), encoding="utf-8")
+    if mode == "crash":
+        raise RuntimeError("stub exploded")
+    if mode == "exit":
+        raise SystemExit(7)
+    if mode == "nosummary":
+        return
+    summary = {"status": mode, "units_done": 1, "units_total": 1, "usd": 0.0, "calls": 0, "usage": {}}
+    (out / "summary.json").write_text(json.dumps(summary), encoding="utf-8")