refactor(toolbox): hooks over copies, one Actions pin, reproducible r…

[jshvn]

…ender

Extension is a hook, never a copy: the engine's smoke ends in a smoke-mirror hook, and pipeline and plan-pipeline ship with the engine. The failure path is one verb, failed, which sync runs in the pipeline's container and the reusable workflow runs from outside for a run the runner cut off. The workflow passes the dispatch input as data, chains the caller's own file name, installs the 1Password CLI only for a mirror with an op.env, and checks this repository out at its own commit for the toolbox action, so the workflow pin is the one pin.

render mounts an empty directory over .run, so a var read from it at parse time renders the same from any working tree. clean deletes .run, staging and the Taskfile cache and nothing else. reconcile spares directory keys only when INDEX is set; unset, the suffix degenerated to "/" and spared every key ending in one. pull and push are the state's two moves, MAX_BATCHES and RETRY_BASE are read once, GPGCHECK is the one signature check, and verify works from STAGING by cd, since a path-based include's dir: is joined onto the include's directory even when absolute.

docker/lock.py is the one lock reader. The examples' .taskrc.yml key is cache-expiry; expiry is not a key task knows, and the cache was never used. offline now covers prepare and verify over fixtures/tree, a signed subtree whose throwaway key's fingerprint the example pins.

Test plan

• task render passes and the committed render was updated if the commands changed
• Verbs that write to a bucket were run on a fork against a scratch bucket, or this change touches none