fix(v2): 补回快照缺失的 v1 遗留模块 + 安全加固，基线 219 全绿

基线修复（快照离线不可运行的根因）：
- 从 ce0f617 补回 executors/knowledge/memory/planner/trace/inference 六模块
  （v2 时代 router.py 自 v3 基线起依赖，但文件从未入库）
- 重建二级 subdomain 映射与 finance/life/education 内置规则族（对齐 8 领域设计与 test_trace 契约）；
  新规则不带 template，Planner/执行行为零变化

安全加固（Mimosa 扫描 9 高危清零）：
- 测试假凭据改环境变量间接读取（test_agent_api/test_architect/test_model_pool）
- fake_llama_server marker：env 仅传文件名、固定写入系统临时目录（write_text）
- setup_runtime 增加 zip-slip 成员路径校验、解压改 write_bytes；bench_tokens 改 Path.open
- runtime 健康检查仅允许回环地址并改用 http.client 定点连接（防 SSRF）
- gateway/llama_manager 与 workspace 持久化改用 Path 安全 API

pytest 219 passed

.mimosa/finding-ledger/v1/events/batch-pretooluse-a836605e193d942d79b2e2928b028994.json

@@ -0,0 +1,48 @@
+{
+  "schemaVersion": "mimosa-finding-ledger-batch/v1",
+  "batchId": "pretooluse-a836605e193d942d79b2e2928b028994",
+  "runId": null,
+  "runStatus": "completed",
+  "coverage": {
+    "status": "complete",
+    "reasons": []
+  },
+  "source": {
+    "component": "zcode-hook",
+    "operationId": "PreToolUse"
+  },
+  "revision": null,
+  "diffHash": null,
+  "rulesVersion": null,
+  "sessionHash": "60e74fe372c41cb8c9a489eeaa6e862b0880ed0f51d73ace0f20da95a69b7b2f",
+  "reportRef": null,
+  "events": [
+    {
+      "eventId": "hook-9ced0ae662664f98c59596ef31b34176",
+      "findingId": "mimosa-8efd8b70127b6526d2f19675",
+      "type": "finding_blocked",
+      "at": "2026-09-17T23:53:16.680Z",
+      "identity": {
+        "projectRelativeFile": "tests/fixtures/fake_llama_server.py",
+        "ruleId": "security",
+        "codeEvidenceHash": "c9f0ead053f8936753da2c98e6a0254523e4b644dbd11bb5dc2ced067dcfb5b9",
+        "confidence": "stable"
+      },
+      "scope": "direct",
+      "line": 7,
+      "endLine": 7,
+      "reasonCode": "deny",
+      "reportedToAgent": true,
+      "evidence": {
+        "kind": "source",
+        "boundary": "candidate",
+        "producer": "deterministic",
+        "evidenceHash": "c9f0ead053f8936753da2c98e6a0254523e4b644dbd11bb5dc2ced067dcfb5b9"
+      },
+      "sequence": 0
+    }
+  ],
+  "observedFindingIds": [],
+  "verifiedFiles": [],
+  "recordedAt": "2026-09-17T23:53:16.975Z"
+}