feat(orchestrator): harden zero-impact shadow rollout

Gate and bound Portal shadow observations while preserving Native execution. Add fail-closed service boundaries, terminal retention controls, Canary readiness telemetry, ops visibility, and isolated regression coverage.

services/orchestrator/executor-gateway.test.mjs

@@ -162,6 +162,53 @@ test('Executor Gateway cancellation is idempotent and never invokes a disabled a
   assert.equal(await gateway.listEvents('missing-job'), null);
 });
 
+test('Executor Gateway deletes only terminal jobs and their private request state', async () => {
+  const gateway = createExecutorGateway();
+  await gateway.createJob(request());
+  assert.equal(await gateway.deleteJob('job-1'), true);
+  assert.equal(await gateway.getJob('job-1'), null);
+  assert.equal(await gateway.listEvents('job-1'), null);
+  assert.equal(await gateway.deleteJob('job-1'), false);
+
+  const activeGateway = createExecutorGateway({
+    registry: createPhase5ExecutorAdapterRegistry({ enabledExecutors: ['aider'] }),
+    executionEnabled: true,
+  });
+  await activeGateway.createJob(request());
+  await assert.rejects(
+    () => activeGateway.deleteJob('job-1'),
+    (error) => error.code === 'EXECUTOR_JOB_NOT_TERMINAL' && error.status === 409,
+  );
+});
+
+test('Executor Gateway exposes only terminal workflow-linked retention candidates', async () => {
+  let now = 1000;
+  const gateway = createExecutorGateway({ nowMs: () => now });
+  await gateway.createJob(request({
+    metadata: { workflowRunId: 'run-retention-1' },
+  }));
+  assert.deepEqual(
+    await gateway.listRetentionCandidates({ before: 999 }),
+    [],
+  );
+  assert.deepEqual(
+    await gateway.listRetentionCandidates({ before: 1000 }),
+    [{
+      jobId: 'job-1',
+      workflowRunId: 'run-retention-1',
+      completedAt: 1000,
+    }],
+  );
+
+  now = 2000;
+  await gateway.createJob(request({
+    jobId: 'job-without-link',
+    idempotencyKey: 'without-link',
+    metadata: {},
+  }));
+  assert.equal((await gateway.listRetentionCandidates({ before: 3000 })).length, 1);
+});
+
 test('Executor Gateway reports implemented capability while execution remains disabled', () => {
   const status = createExecutorGateway().status();
   assert.equal(status.version, 'executor-gateway-status-v1');