refactor(issue-17): item 4 - the delegate-job wrapper's decisions move to Python

The wrapper keeps spawn / wait / kill, key injection and the herdr
diagnostic probe; what it decided in bash is now lib_py/delegation/wrapper.py,
reached through one `_decide` helper:

- finalize_unfinished: the clock choice, the disk grace and broker
  re-observation, the close request / label, the close and the event
  (finalize-begin / finalize-end; bash runs only the busy probe between them)
- start_stall_watch: whether to watch (MAM_STALL_WATCH, remote, human)
- _map_sub_rc, _rc_for (+ MAM_DELEGATE_FAIL_CLOSED), the subscriber
  early-exit check and cmd_wait's rc normalisation
- mam_int / mam_int_knob run lib_py/ints.py, which is also the runner's
  _positive_int: one implementation of the Issue #26 rule

No behaviour change: tests/test_issue17_item4_decisions.py runs the old
bash functions (copied verbatim from 7209750) and the new wrapper on the
same inputs and compares output, FINAL_JOB_STATUS and the registry /
publish calls. Three static tests that pinned the old bash literals now
pin the Python entry points instead.

Refs #17

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/test_issue5_phase1_delegation.py

@@ -385,15 +385,16 @@ def test_event_to_status_mapping_is_frozen(mam_sandbox):
 def test_wrapper_exit_code_mapping_literals_are_frozen(mam_sandbox):
     wrapper = SKILLS / "multi-agent-mux-delegate-job" / "multi-agent-mux-delegate-job"
     text = wrapper.read_text(encoding="utf-8")
-    for literal in (
-        'if [[ $sub_rc -eq $SUB_RC_COMPLETED ]]; then',
-        'elif [[ $sub_rc -eq $SUB_RC_ERROR ]]; then',
-        'elif [[ $sub_rc -eq $SUB_RC_BROKER_UNAVAILABLE ]]; then',
-        '[ "$sub_rc" = "$SUB_RC_WALL_CLOCK" ] && clock="wall"',
-        'job_status="completed"',
-        'job_status="error"',
-    ):
+    # Issue #17 item 4: the mapping moved to lib_py/delegation/wrapper.py; the
+    # wrapper reaches it only through `_decide`.
+    for literal in ('_decide sub-status "$sub_rc"', '_decide exit-code "$job_status"', "--sub-rc \"$sub_rc\""):
         assert literal in text, literal
+    decide = _import_delegation(mam_sandbox, "wrapper")
+    assert decide.EXIT_CODES == {"completed": 0, "error": 1, "timeout": 2, "broker_unavailable": 3, "cancelled": 5}
+    assert [decide.sub_status(rc, str(mam_sandbox), "none") for rc in range(6)] == [
+        "completed", "error", "timeout", "broker_unavailable", "timeout", "timeout"]
+    assert (decide.SUB_RC_COMPLETED, decide.SUB_RC_ERROR, decide.SUB_RC_NO_EVENT, decide.SUB_RC_BROKER_UNAVAILABLE,
+            decide.SUB_RC_WALL_CLOCK) == tuple(int(v) for v in re.findall(r"\bSUB_RC_[A-Z_]+=([0-9]+)", text))
     # Issue #33: the wrapper's SUB_RC_* mirror job_subscriber's RC_* exactly,
     # and the wrapper compares subscriber codes only by those names.
     job_subscriber = _import_delegation(mam_sandbox, "job_subscriber")