test(issue-5): phase 1 delegation characterization suite

The three lib.sh delegation helpers (delegate_submit_job,
delegate_publish_event, start_watchdog) had zero direct test coverage, so a
"full suite green" gate would have been vacuous for the Phase 1 extraction.
Add the regression oracle before the move:

- C-01..C-09 golden tests for the shell helpers: the non-fatal contract (empty
  job id, missing script, non-zero interpreter exit), exact argv forwarding,
  stdout-is-the-job-id-alone, and the daemon's PID/dedup/log-path behaviour.
  All are parametrized over MAM_DELEGATION_PY so the legacy and python bodies
  must agree.
- CLI contract snapshots taken from the argparse parsers rather than --help
  text, so wording stays free to change but option names, choices and defaults
  do not.
- Auto-completion invariant guards for the three surfaces that decide job
  status: EVENT_TO_STATUS, the wrapper's exit-code mapping, and reconcile.sh's
  terminal mutation literals.
- conftest: PV-2/PV-3 session guards asserting that every non-delegation
  lib_py.* module resolves to the real skills tree and that no temp-tree
  sys.path entry contributes a lib_py package. MAM_ENV_FILE is pointed at an
  absent file inside the sandbox so delegation code can never inject the real
  .mam.env into a test process.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UrDNJkHmm18uu7n7JwV5Qd

tests/fixtures/issue_5/phase1/help-publish_event.txt

@@ -0,0 +1,22 @@
+usage: publish_event.py [-h] (--job JOB | --pick-pending)
+                        [--agent-session AGENT_SESSION]
+                        [--event {started,permission_required,progress,completed,error,cancelled}]
+                        [--detail DETAIL] [--data DATA] [--retained]
+                        [--registry-dir REGISTRY_DIR] [--attempts ATTEMPTS]
+                        [-v]
+
+Publish a Job event to MQTT
+
+optional arguments:
+  -h, --help            show this help message and exit
+  --job JOB             job id to publish for
+  --pick-pending        auto-select a pending job for --agent-session
+  --agent-session AGENT_SESSION
+                        session label used with --pick-pending
+  --event {started,permission_required,progress,completed,error,cancelled}
+  --detail DETAIL
+  --data DATA           optional JSON object string
+  --retained            force retain=True (auto for completed/error)
+  --registry-dir REGISTRY_DIR
+  --attempts ATTEMPTS
+  -v, --verbose