fix(security): active guard enforcement, CEO A2A target check, notification expiry (#595)

* fix(security): guard goes active; CEO A2A respects no-comms roles; ack notifications expire

ROBOCO_GUARD_PASSIVE_MODE defaults to false in both compose files — the
deferred post-calibration flip; fail_secure stays off and the env override
remains the rollback. can_a2a_direct no longer short-circuits the CEO past
the no-comms set (auditor/pr_reviewer/prompter/secretary), now canonical
in foundation.policy.communications.NO_COMMS_ROLES and shared with the
content-actions gate; the A2A service refuses at conversation creation
instead of silently suppressing the wake. Ack-required notifications get
expires_at stamped from ROBOCO_NOTIFICATION_ACK_TTL_HOURS (default 48,
0 disables), so the re-escalation sweeper's expires_at query matches rows
for the first time.

* refactor(notification): extract _ack_and_expiry — xenon rank back under B

The expires_at stamping pushed _create_notification_with_session to
rank C; the requires_ack + expiry derivation moves into a helper with
the same semantics and comments.

* test(conftest): dispose the global DB engine after every test

Production code reaching get_db_context()/get_engine() lazily creates the
process-global engine bound to the current event loop; with per-test
function-scoped loops, any later test touching the global path inherits a
dead-loop engine and dies with 'Future attached to a different loop' —
the order-dependent class that has been wandering the suite (cloud_auth
login, metrics, tasks-routes, full-lifecycle) whenever collection order
shifts. An autouse fixture now close_db()s after every test, keeping the
global path loop-local; no-op when untouched.

---------

Co-authored-by: Renn F <rennf93@users.noreply.github.com>

docker-compose.yml

@@ -633,14 +633,16 @@ services:
       # that would respawn forever. Default-OFF in config; ARMED here (inert in
       # practice: every real delivery role is gateway-enabled). OFF in registry.
       ROBOCO_SPAWN_PREFLIGHT_ENABLED: ${ROBOCO_SPAWN_PREFLIGHT_ENABLED:-true}
-      # fastapi-guard HTTP security layer (v0.16.0). ARMED here in PASSIVE /
-      # log-only calibration mode: guard mounts + observes + logs what it WOULD
-      # block, but blocks nothing until PASSIVE_MODE is flipped off after the
-      # false-positive review. FAIL_SECURE=false so a guard-internal error never
-      # 500s this personal deploy. Left OFF entirely in the registry compose.
+      # fastapi-guard HTTP security layer (v0.16.0). ACTIVE enforcement: passive
+      # / log-only calibration (WAF false-positive review, see
+      # docs/rag/architecture/http-security-guard.md) came back clean, CEO
+      # approved flipping to active now that cloud auth + Tailscale are armed.
+      # Guard mounts, observes, AND BLOCKS matching requests. FAIL_SECURE=false
+      # so a guard-internal error never 500s this personal deploy. Left OFF
+      # entirely in the registry compose.
       # enforce_https follows ROBOCO_ENVIRONMENT (dev on the NAS → not enforced).
       ROBOCO_GUARD_ENABLED: ${ROBOCO_GUARD_ENABLED:-true}
-      ROBOCO_GUARD_PASSIVE_MODE: ${ROBOCO_GUARD_PASSIVE_MODE:-true}
+      ROBOCO_GUARD_PASSIVE_MODE: ${ROBOCO_GUARD_PASSIVE_MODE:-false}
       ROBOCO_GUARD_FAIL_SECURE: ${ROBOCO_GUARD_FAIL_SECURE:-false}
     volumes:
       # Docker socket - allows spawning agent containers