Harden standalone Fable process bounds and review-run identity

[BaseInfinity]

Evidence

The final Sol High + Fable High review for #167 certified the required dual-review path, but both reviewers identified two nonblocking P2 gaps isolated to the standalone fable-review.cjs adapter:

1. Its live preflight uses a synchronous timeout boundary that does not itself prove the complete child process tree is terminated on timeout or cancellation.
2. It validates the requested/actual model during preflight, then accepts the certifying review without independently validating model identity from that review runs own init stream.

The dual-review path added by #167 is candidate-bound, supervised, and certified. This issue must not reopen #167 or become a 1.0 blocker without new evidence.

Scope

• Put standalone preflight and review execution under the same bounded process-tree supervision contract used by the dual-review path.
• On timeout or cancellation, terminate descendants on POSIX and Windows and write a truthful non-certifying receipt.
• Validate the actual standalone review model from its own structured init envelope, not solely from a preceding probe.
• Preserve the fix(review): prevent Fable built-in tools before required review #167 zero-tools contract and fail closed on any tool event or non-empty advertised tool list.
• Keep retry limited to classified transient infrastructure failures.

Acceptance criteria

• A synthetic preflight child that leaves a descendant is fully reaped after timeout on POSIX and Windows.
• Cancellation reaps the complete standalone preflight/review process tree.
• A preflight with the expected model followed by a review init with the wrong model fails closed and cannot certify.
• Missing, conflicting, or multiple incompatible review init identities fail closed with a non-certifying receipt.
• Expected model plus zero advertised tools plus an exact valid verdict can certify under normal rules.
• Existing dual-review behavior remains unchanged and the full canonical proof passes.

Related

• feat(review): add heartbeat, timeout, cleanup, and structured verdict metadata #137 supplied the lifecycle and process-tree supervision contract.
• fix(review): fail closed on unavailable Fable and bind the actual reviewer identity #143 supplied truthful requested-versus-actual reviewer identity.
• fix(review): prevent Fable built-in tools before required review #167 supplied the zero-tool Fable lane and produced this follow-up evidence.