mecatequi: authenticated Summary carriage (nonce echo or file carriage) so a runner can tell mecatequi's Summary from agent-authored log text

From an external security review of mecatequi's k8s-arm panel (security finding MAJ-1, CWE-345 / OWASP LLM05).

With --out-summary=-, the Summary shares the container's stdout with everything the agent prints. A runner scanning the merged log stream cannot authenticate the final line's author: an injected agent with shell access can print a forged schema-1 Summary line (e.g. via a backgrounded loop to /proc/1/fd/1) that lands after mecatequi's real one — forging stop_reason=end_turn + non_empty_diff and turning a clean non-completion into a recorded success upstream.

The reviewer's interim control: an ambiguous tail — more than one parsing Summary line — is treated as unreportable. That fails closed but turns forgery attempts into failed runs rather than detecting the author.

Structural options (mecatequi-side):

1. Nonce echo: a --summary-nonce <value> flag (or env) whose value mecatequi must include as a nonce field in the Summary; the runner generates it per run and matches on read. Agent code never sees the value if it's argv-delivered... note argv IS visible via /proc on shared-pid — so env delivery with envscrub denylisting it is the right carriage.
2. File carriage on a runner-provided path outside the agent's writable tree, plus a documented fchmod/ownership story.

Relates to #358/#359 (the other two k8s-arm exit conditions); token budgets (usage is agent-authored input) raise the same trust question separately.

Start at the --out-summary=- emission path and the runner's merged-log Summary parser. Compare the --summary-nonce environment-carriage option with file carriage, including how the runner supplies and matches the value and prevents agent access. Done means the runner can authenticate mecatequi's Summary despite forged agent output, with the chosen carriage documented.