merge: integrate final-artifact-vault into local_dev (authorized exception)

User authorized lifting CURRENT FAV whole-branch merge protection on
2026-09-23. Keep FAV_DEGRADED_READ/FAV_PUBLISHER_ENABLED default false.
Drop duplicate goose 00034 (local_dev already has 00036). Preserve
agentx workspace admin routes and pin-export wiring.

scripts/artifact-vault-preflight.sh

@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+# Fail-closed FAV coverage / destroy preflight. Does not start env-service.
+set -euo pipefail
+DSN="${APP_DB_DSN:-${TEST_DATABASE_URL:-}}"
+if [[ -z "$DSN" ]]; then
+  echo "APP_DB_DSN or TEST_DATABASE_URL required" >&2
+  exit 2
+fi
+exec go run ./cmd/artifact-vault gc-preflight --dsn "$DSN" --backup-ok="${BACKUP_OK:-false}" --corpus-ok="${CORPUS_OK:-false}"