[INFRA] Ship the Phase-2 CI gates + nightly live-e2e from the #188 roadmap

[vutuanlinh2k2]

Context

Roadmap #188's Phase-1 keystone shipped, but its Phase-2 guards did not: provision-payload size gate, prompt byte budget, onErrorEvent fail-loud, catalog import-graph walker, E2BIG env check, and a nightly workflow flipping the existing RUN_*_LIVE_E2E flags. The vertical has unit + composition tests but no live sandbox turn in CI — the exact class behind recurring 'green CI, dead in prod' regressions.

Problem / Goal

Land the five CI gates and a nightly live-e2e run.

Acceptance Criteria

• All five gates run in CI and fail on violation.
• Nightly workflow executes at least one real sandbox chat turn end-to-end.

Notes

Implements the unchecked Phase-2 items of #188.