fix(op): mint each runtime environment's Root from the spec's anchor - #402

A RuntimeEnvironmentSpec carried a live fsroot.Root, so every path that
minted one without reaching a closing Run leaked the confined Root's
directory handle. Windows refuses RemoveAll on an open directory, which
is why 18 of the standing 48 windows-leg failures are t.TempDir()
cleanup failures rather than assertion failures; POSIX unlink hides the
identical leak.

Per the amended #393 ruling (option 4), the spec now carries only the
anchor path and access mode -- serializable values, never a handle.
NewRuntimeEnvironment mints the Root through the new fsroot.Open(dir,
mode) and RuntimeEnvironment.Close releases it, the single-owner
contract it already held. Nothing mints before environment build, so the
pre-Run error paths cannot leak. Resume is no special case: every Run
mints fresh from the anchor, which is all that survives a cross-process
resume anyway.

The deciding fact was verified across the tree before the ruling was
amended: nothing between spec construction and Run dereferences the
spec's Root. The field had exactly two production readers, all nine host
mint-to-Run gaps were clean, and no .star script or doc touches
spec.root.

NewRuntimeEnvironment now returns an error, and a mint failure at Run
lands the preflight-failed terminal before any dispatch. Provider.Spec
keeps its fail-fast contract by probing the anchor open-and-release, so
the mint itself stays the only definition of a valid root. Six writ spec
factories lost their only error source and are now infallible; adopt and
migrate-register collapse their planning and execute spec pairs into one
shared spec.

Three defects heal with it. cmd/lore's deploy loop handed one spec to N
executors, so every iteration after the first dispatched against a Root
the previous run had closed. devlore-test aliased the spec's root into
TestContext for post-close reads plus a double close, benign only
because unconfined Close is a no-op. verify and readback never closed
their loading environments at all; both now do, through iox.Close.

Riders: cmd/lore/lore/integration_test.go removed (//go:build ignore,
referencing op.contextBase and other long-deleted APIs); and a go-style
sweep over the touched set -- 77 multi-line doc summaries split, 37
over-120-column lines rewrapped, one blank-line-after-signature added.

Verified: make test reports zero failures repository-wide; make vet-all,
lint-all, and build-all are green on linux, darwin, and windows (lint
reports 0 issues per GOOS); gofmt clean over all 41 files. The -18 on
the windows leg is CI-side proof -- POSIX cannot observe the leak.

Assisted-by: Claude
Signed-off-by: David Noble <[email protected]>

The first windows measurement on this PR came back 48 -> 45, not the
predicted ~30. Fifteen failures still carried the leak signature, and
none of them were the production paths #393 diagnosed: they are test
environments that are never closed. Whoever constructs a runtime
environment closes it; these tests never did -- before this branch or
after -- so relocating the mint could not fix them.

A natural experiment inside the plan package proves it. lifecycle_e2e,
lifecycle_starlark, and result_flow_starlark each close their
environment and none of their tests appear in the failure list;
provider_test (2 mints), lifecycle_api (10), gather_api (1), git_resume
(1), and receipt_integration (1) close nothing and all of their tests
do. Fifteen unclosed mint sites, fifteen leak failures.

Add t.Cleanup(func() { _ = environment.Close() }) at all fifteen,
matching the idiom the three passing helpers already use. Verified by
enumeration rather than assumption: repo-wide, every test file that sets
a root now closes it. The files that mint without a root hold no handle,
and TestNewRuntimeEnvironment_BadAnchorFails mints nothing because the
mint is what fails.

The plan document records the miss rather than quietly restating the
target: the option-4 verification asked whether anything dereferences
spec.Root between spec construction and Run (it does not, and that
holds), but never asked who closes the environment in the failing tests.
The -18 estimate was inherited from the #393 diagnosis and repeated
without its own enumeration.

Expected windows effect: 45 -> ~30. Unlike the first estimate, this one
names its mechanism -- fifteen unclosed handles, fifteen cleanups.

Assisted-by: Claude
Signed-off-by: David Noble <[email protected]>