* fix(qa): keep leases when Gateway startup teardown fails
Retain a synchronous QA child owner through startup, replacement, and explicit finalization. Release Gateway-backed transport leases only after authoritative process settlement, independently of cleanup diagnostics. Preserve failure artifacts and primary fixture errors.
Fixes#131643
* test(qa): keep fixture cleanup inside plugin boundaries
* test(qa): retain integrated fixture owners and stop observations
* ci: follow renamed local JSONL socket owner in CodeQL
* test(qa): record reviewed cleanup error suppressions
* test(ci): exercise PR-native network semantic review
Route sensitive changes into the existing semantic gate and restore configured net-policy coverage. Add actual query fixtures, including an intentional red checkpoint for JavaScript-family raw clients before the follow-up predicate repair. PR remains draft until semantic proof and final CI pass.
* fix(ci): classify supported JavaScript network sources
Preserve the existing directory and owner boundaries across TS, MTS, JS, and MJS. Hosted semantic regression 33190472078 failed on exactly the three missing executable rows; expected findings and test exclusions remain unchanged.
* test(ci): isolate network fixtures and retain guard coverage
Use independent fixture stems and explicit MTS extractor inputs while preserving every expected finding. Scan the semantic fixture root for duplicates and keep the exact socket-owner assertion insensitive to formatting.
* test(qa): return confirmed stop in WhatsApp cleanup fixture
* test(qa): own Discord attachment gateway before startup
* ci: fail closed on unavailable CodeQL diff metadata
* test(oc-path): measure synchronous worker CPU budgets
