test(platform): validate main-system Pilot readiness with Fake Connection

## Problem

Before real Connection and internal resources are available, the assembled Agent Platform needs a small cross-lane proof against a schema-conformant Fake Connection. Lower-level Issues already own exhaustive state, security, crash, and Kubernetes matrices.

## Scope

- Add one happy-path Playwright/integration journey from employee application through approval, Workload creation, Owner configuration, Web Codex text task, and Fake delegated GitHub result.
- Add one cross-user/unauthorized journey proving server-authoritative identity and non-enumeration.
- Add one browser disconnect and SSE cursor recovery journey proving persisted history resumes without duplicate visible events.
- Add one Digest A-to-B upgrade with invalid C rejection/rollback journey proving the assembled route keeps the last verified revision.
- Validate trace/request/Agent/Conversation/Execution/call correlation and evidence redaction across those four journeys.
- Do not repeat the exhaustive API/Worker/RuntimeHost/Pod failure injection, authorization matrix, or Kubernetes lifecycle suites owned by the component Issues.
- Use only Fakes/local resources; the real GitHub Pilot and 5-day observation remain in the final cross-map Pilot.

## Acceptance criteria

- [ ] **AC-1:** The happy path completes the non-preprovisioned Codex text journey through all five main-system lanes.
- [ ] **AC-2:** The denial path proves one representative cross-user request cannot discover or use the target resource.
- [ ] **AC-3:** The reconnect path resumes persisted events once without loss or duplication.
- [ ] **AC-4:** The upgrade path routes only the verified revision and preserves Platform state after invalid C.
- [ ] **AC-5:** All four journeys expose complete correlation and no message body, model thought, credential, private key, grant, or internal deployment value.

## Validation

- Run the four focused full-stack journeys and the complete repository validation sequence in `AGENTS.md`.

## Blocked by

- #186
- #190
- #192
- #193
- #285
- #286
- #287
- #288
- #317
- #318
- #319
- #320
- #321
- #322
- #323
- #324
- #389
- #403
- #404
- #405
- #406