Qualify packaged worker hostile inputs and cancellation

[dovvnloading]

Summary

• Expand the signed packaged-worker qualification harness to cover a normal transform, truncated-PNG rejection, active-SVG rejection, and in-flight cancellation.
• Keep broker payloads below the 64 KiB authenticated-frame ceiling by using a conservative 32 KiB qualification chunk.
• Add bounded per-case cleanup, fail-closed diagnostics, and an optional --case selector for targeted gate reruns.
• Record the evidence and remaining Phase 2 release gates in the ADR and qualification README.

Why this is needed

The prior qualification proved only the happy-path transform. It did not establish that hostile decoder bytes are rejected inside the signed worker or that cancellation reaches an active packaged transform. During this work the expanded gate also caught a real harness framing defect: a 48 KiB worker chunk expands beyond the broker frame limit after base64 and envelope overhead. The qualification harness now exercises the worker through the corrected transport bound and preserves failure details without exposing payloads.

Validation

• Full signed packaged-worker gate (--json --strict): all four cases passed, including cancel_ack after input_complete.
• Focused Phase 2/parser/artifact/security regression set: 114 passed, 1 Windows-inapplicable skip.
• Full Python suite: 260 passed, 1 Windows-inapplicable skip, 1 existing pytest-asyncio deprecation warning.
• compileall and git diff --check passed.
• No production execution provider is enabled by this change.

Release-gate status

This closes the packaged hostile-decoder and cancellation qualification evidence. Parser fuzzing, resource/watchdog accounting, artifact security review, external review, and production lifecycle health/wiring remain explicit blockers before provider enablement.

Cortex.pyproj was intentionally excluded because it contains an unrelated user edit.

Builds on the merged worker transport fix in #52.