[codex] Route Path linkage through governed actions

[rita-aga]

Summary

• Adds governed Path actions for repairer/adversary assignment and dweller challenge-flag append.
• Replaces raw Path PATCH calls in Foresight WASM with bound TemperPaw actions to remove the verified denied-PATCH waste class.
• Records ADR-009 and ARN-50 proof with Datadog filter corrections and bottleneck numbers.

Evidence

• Canonical Foresight filters: @version:sha-foresight-dd-638ff9b1 and @peer.service:foresight-supabase; plain version: returned zero buckets.
• Foresight-only 10-minute sample: 81 HTTP spans, 1,218 Postgres spans, 28,305 internal spans.
• Hot DB spans were idle/wait dominated: e.g. 136-487 ms wall with roughly 0.11-2.67 ms busy.

Scope note

This is not the full write-amplification fix. The current higher-leverage DB path remains snapshot/projection/catalog/index writes; this PR removes the verified denied Path PATCH class first, without widening inference concurrency or changing provider.

Verification

• cargo test -p temperpaw --test corridor_engine_contract --test corridor_cedar_matrix
• cargo test --manifest-path os-apps/paw-foresight/wasm/spawn_repairers/Cargo.toml
• cargo test --manifest-path os-apps/paw-foresight/wasm/spawn_adversaries/Cargo.toml
• cargo test --manifest-path os-apps/paw-foresight/wasm/animate_dwellers/Cargo.toml
• bash os-apps/paw-foresight/wasm/build.sh