plane black box: one runner boots the real binary against every linked door's case files

[MattJackson]

Stacked on #1006 (draft until it lands, rule 19).

What

• build.rs. It reads DEP_<LINKS>_BLACKBOX for every enabled plane door, using the same links name as the cells, so a path dependency and a pinned dependency resolve the same way.
  • It emits DOOR_BLACKBOX: &[(crate, dir)] into door_cells_files.rs.
  • It states BUSBAR_LINKED_AXES as data.
• tests/plane_blackbox.rs. One test iterates every linked door's directory.
  • For each case it writes the case's files and starts the far ends the case asks for: a scripted JSON-RPC responder, the JWKS issuer over loopback TLS, a signed auth plugin, a signing key.
  • It then boots CARGO_BIN_EXE_busbar, drives it, and holds every answer to the case.
  • The Rust knows JSON, HTTP/1.1 and JSON-RPC 2.0 framing only. It names no plane, dialect or instance (law0 measure of the new files: 0).
• Rigs reused and shared. tests/common/{credentials,lines,upstream}.rs hold what mcp_stdio_serve.rs and qa_mcp_integrity.rs carried privately; both suites now use them.
• a2a door. It states blackbox=<crate>/tests/blackbox with one seed case, so the resolution path runs in CI.

Schema blackbox/1 (case file, JSON)

Top-level fields:

• schema (required), case (required), oracle? (a 1.5.5 golden cell id). The cited cell is COMPARED: its recorded bytes are read from golden/1.5.5/cells/<id with | as __>.json, and the case's last status-stating step is held to them. The status must equal the cell's status. Every stated body or line must match the cell's body.text/body.json and effects.stderr: a _line_eq is a whole line of the record, a _contains is in it, a _lacks is not, and an admin json_eq holds the recorded value. A citation that states no byte is refused. Any difference fails naming the plane, the case and the cell
• requires?{sections,axes,features}: a build lacking any of these makes the case N/A. Axes are named as the manifest's linked-axes rows name them, e.g. body-ingress.
• unless?[axis]: a build linking any of these axes makes the case N/A, so the case runs only where the axis is absent.
• A directory whose cases are all N/A fails.
• files?{name: text}, vars?{NAME: value}, unset?[NAME]
• credentials?{auth_plugin?{module,alias,first_party?}, issuer?, signing_key?}
• upstream?{methods:{m: {result}|{echo:{from,into,base?,format?}}}}
• steps[]

Steps:

• validate{args?,exit?,stdout_contains?,stderr_contains?,output_contains?,output_lacks?,stdout_line_eq?,stderr_line_eq?}
• boot{args?,expect: listening|exit,exit? (implies expect: exit; refused beside expect: listening),listening?[data|admin],within_secs?,exit?,output_contains?,output_lacks?}
• session{flag,credential_var?,credential?,expect: served|refused,script?[send|recv{method?,pointer_eq?,has?,contains?}|repeat{max,send,elicitation?{method,message_pointer?,message?,answer},served_has?,served_contains?,refused_contains?,min_served?,elicitations_equal_served?}|eof{exit?,within_secs?}],no_frames?,output_contains?,output_lacks?}
• call{port?,method?,path,headers?,bearer?,body?,status?,body_contains?,body_lacks?}. Every JSON-RPC reply, whether the body or an event-stream data: line, must carry its request's id; this is always on, with no opt-out. The same check runs on every repeat round.
• admin{method?,path,body?,status?,json_eq?}
• mint{path?,body?,bind_audience?}
• upstream_set{method,result|echo}
• upstream_counts{since: last|start,counts:{m: "+N"|"=N"|">0"}}

Placeholders:

• {dir}, {plugins_dir}, {data_port}, {admin_port}, {admin_token}, {upstream_url}
• {token:<aud>}, {issuer_settings:<indent>:<aud>}
• {signing_key_file}, {signing_key_hex}, {minted}
• {i}, inside repeat.send only

An unknown field, step or placeholder is refused.

REDs

• a_malformed_case_is_refused_naming_the_plane_and_the_case: unknown field, unknown step, missing name, wrong schema, unknown step field.
• a_mismatch_fails_naming_the_plane_and_the_case: --version expected nonzero fails at step 0 (validate); the exit-0 control runs clean.
• a_door_stating_a_black_box_directory_with_no_cases_fails.
• the_scripted_far_end_answers_what_the_case_states_and_counts_it.
• a_boot_step_is_held_to_the_exit_it_states.
• unless_runs_a_case_only_where_the_axis_is_absent.
• a_reply_under_a_foreign_id_fails_the_call.
• a_cited_cell_whose_bytes_differ_fails_naming_the_plane_the_case_and_the_cell: a wrong line, a wrong status, and no byte stated all fail; the cell's own bytes hold (the control). The a2a seed case cites cli|--version.

Ledger

busbar auth 49 -> 47, plane 772 -> 771, transport 200 -> 195. The moved rigs no longer name instances; the new files measure 0.