feat(v1): harden typed runtime boundaries

Elect one canonical EffectBatch codec, remove the parallel postcard API, and strengthen fail-closed host, form, sync, WASM, macro, generated-contract, and test-harness proofs with mutation-driven coverage.

req: wire/008

req: wire/009

req: wire/010

req: push/008

req: client_local/015

req: client_local/016

req: client_local/017

req: client_local/018

req: client_local/019

req: sync/024

req: sync/025

req: sync/026

req: sync/027

req: sync/028

req: sync/029

req: test/020

req: test/021

docs/v1-readiness.md

@@ -16,9 +16,12 @@ closure. Their implementation order lives in `PLAN.md`. req: examples/001 req: p
 - Production reference: authenticated mutation, origin/CSRF denial, atomic
   rollback-safe persistence, restart recovery, health/readiness, diagnostics,
   metrics, CSP, and mixed-build fail-closed recovery proven.
-- V1 closure matrix: local workspace, browser, performance, docs, and example
-  gates pass. Warning-denied vulnerability and source audits are clean; strict
-  license closure awaits a repository license allowlist.
+- V1 closure matrix: not closed. The recorded local workspace, browser,
+  performance, docs, and example gates pass, and warning-denied vulnerability
+  and source audits are clean. Strict license closure still awaits a repository
+  license allowlist, and the mutation-testing release gate is only partially
+  classified. These open gates block a feature-complete or production-ready
+  claim. req: test/020 req: test/021 req: v1_release/006
 - Publishing and deployment: explicitly unauthorized.
 
 ## Baseline evidence
@@ -176,7 +179,7 @@ cargo test -p hemx-derive --test compile_fail
 cargo test -p hemx-test --test examples_contract
 redgate list
 redgate refs
-redgate health --strict
+redgate health
 git diff --check
 ```