feat(orchestrator): harden zero-impact shadow rollout

Gate and bound Portal shadow observations while preserving Native execution. Add fail-closed service boundaries, terminal retention controls, Canary readiness telemetry, ops visibility, and isolated regression coverage.

scripts/smoke-orchestrator-shadow.mjs

@@ -42,6 +42,22 @@ async function waitForShadowEvent(pool, runId, timeoutMs = 15_000) {
   throw new Error(`Timed out waiting for Shadow projection for run ${runId}`);
 }
 
+async function deleteOrchestratorRun(runId) {
+  const response = await fetch(`${serviceUrl}/v1/runs/${encodeURIComponent(runId)}`, {
+    method: 'DELETE',
+    headers: {
+      authorization: `Bearer ${serviceToken}`,
+      accept: 'application/json',
+    },
+  });
+  if (response.ok) return;
+  if (response.status === 404) {
+    const body = await response.json().catch(() => null);
+    if (body?.error?.code === 'RUN_NOT_FOUND') return;
+  }
+  throw new Error(`Orchestrator run cleanup failed with HTTP ${response.status}`);
+}
+
 async function main() {
   if (!isDatabaseConfigured()) {
     throw new Error('Shadow smoke requires the local Memind MySQL configuration');
@@ -132,13 +148,23 @@ async function main() {
       restoreConfig,
     }, null, 2));
   } finally {
-    if (cleanup && runId) {
-      await pool.query('DELETE FROM h5_agent_runs WHERE id = ?', [runId]);
+    let cleanupError = null;
+    try {
+      if (cleanup && runId) {
+        await deleteOrchestratorRun(runId);
+        await pool.query('DELETE FROM h5_agent_runs WHERE id = ?', [runId]);
+      }
+    } catch (error) {
+      cleanupError = error;
     }
-    if (restoreConfig) {
-      await configService.updateAdminConfig(previous.config);
+    try {
+      if (restoreConfig) {
+        await configService.updateAdminConfig(previous.config);
+      }
+    } finally {
+      await pool.end();
     }
-    await pool.end();
+    if (cleanupError) throw cleanupError;
   }
 }