Record bounded AX state after failed A9 r34 diagnostic

[Ketchio-dev]

What changed

• At the existing T17 ui-element-missing timeout, capture bounded PID/process state, raw Accessibility query status, and allowlisted BridgeVM role/identifier observations before owned-app cleanup. The failure code and 60-second dashboard lookup limit stay unchanged. Titles, values, guest paths and pixels are never read into the diagnostic.
• Preserve the failed r34 physical result in history. The strict receipts validated but the single run failed before runtime start/first READY; the final windows=0 query does not establish a cause. A9 and A11 stay OPEN, and product state stays ENGINEERING_PREVIEW.
• Register the new files' actual line budgets and classify the new history note in the document manifest. Keep the registry's tested source at the separate history/budget commit.

Evidence and limits

The failed r34 result came from exact M1 bc5f11e53f704f156016ebf65d9fc150f56b3189; public/private receipt SHA-256 is 373d557f50d6b6a601218c71ecb7ef55a81938ace1fc26ec2f8f466a4d5f19dd. This PR adds diagnostic capture for a future fresh physical run; it proves no clean-machine install/import journey.

The initial unpushed OPEN seal failed freshness because its budget row changed a watched path, and the next attempt failed document classification. Both failed logs and patches are retained privately. The final branch separates source S=33c016f025a1fd454d2d0af3175f0dfeb2ad4c17, history/budget S2=e9a2a68e116c14d394ad50c39b25c2975a8ce0cf, and OPEN seal J3=ffee95abe8eb952a4c1c61ca560e722b05727e80.

Focused Swift, schema/freshness, documentation and structural-budget checks passed on J3. Exact J3 local scripts/check-project.sh --fast passed (retained log SHA-256 dd2b1434fd23c1a8d2881bb582b201ff7debadfca3386769d7a98c2095a02e6d). Exact-head hosted full and PR CI remain required before merge; no A9 capability claim or physical measurement is inferred from those deterministic checks.