Remediate audit P0/P1 findings; migrate tests to green

- state.py: fcntl/msvcrt file locking, reservation+finalization, history
  verification, remove dead subprocess bridges (p1-lock)
- hypotheses.py: enforce canonical status, phase/host/service/port match,
  reject unrelated hypotheses (p1-hyp)
- tools.py/__init__.py: retain kwargs (task_id), lifecycle hooks wired
  (REGISTERED_TOOLS + no-op-then-active hooks) (p1-life)
- Migrate tests from tests/*.py to tests/guard + tests/pentest_docs; align
  to actual API (handle_target returns ips[0], handle_exec_burst fail-closed,
  PTT self-certify uses real batch_id, post-exploitation requires hypothesis)
- scoping.md: add checkpoint.json continuity-artifact drift note
- pyproject.toml: v1.2.0, per-file-ignores for tests/scripts (E402/S101)
- Add .pytest-tmp-plugin/ to .gitignore

64 passed; ruff clean.

.github/workflows/ci.yml

@@ -29,6 +29,6 @@ jobs:
       - name: Run tests
         run: uv run pytest -q -p no:cacheprovider
       - name: Run guard plugin tests explicitly
-        run: uv run pytest -q tests/test_plugin_guard.py -p no:cacheprovider
+        run: uv run pytest -q tests/guard/test_plugin_guard.py -p no:cacheprovider
       - name: Validate release
         run: uv run python scripts/violin_guard.py check-release