test(e2e): the devops gate + delegation lane join the live smoke

[rennf93]

Stacked onto #1109 (merges into the devops PR).

What

Three scripted arcs in tests/e2e_smoke/test_devops_gate.py give the DevOps feature its place in the live smoke suite (it previously had unit coverage only and zero e2e presence):

1. The infra review gate, end to end. An assembled cell→root PR whose diff touches the project's effective infra globs (shipped defaults, no conventions.yml needed) REFUSES the primary reviewer's pr_pass until devops-1 co-claims via claim_gate_review and records a passed verdict, then composes. Both designed rejections are walked explicitly.
2. Flag-off inertia. The identical chain with ROBOCO_DEVOPS_ENABLED off passes with no devops involvement.
3. The delegation lane. A PM-assigned infra leaf flows through the normal authoring lifecycle as devops-1 (give_me_work → claim → worktree → commit → PR → i_am_done → awaiting_qa).

The arcs caught four real production gaps (all fixed here)

• record_devops_review was advertised in the manifest but never exposed by the MCP flow server — a real devops-1 could not record a verdict.
• content_notes had no devops entry while i_am_done demands dev_notes>=min — the delegation lane could never complete. devops now authors the developer section.
• The project agent-access guard had no flag-gated devops exemption (only the task-level one existed) — every delegation-lane claim was wedged behind the assigned-cell rule.
• The content-ownership gate refused the co-claimant's journal note (the verdict verbs demand a learning entry); the co-claim marker now authorizes content.

Plus harness/infra: the smoke app mounts the flow_devops router (it predated the feature); devops-1 joins the seeded canonical company at its static seed UUID; dev_arc creates nested work-file parents; the i_am_done files_changed evidence leg forwards the submitting agent; and agent-image-smoke.yml gains a devops toolchain-smoke job (build + every pinned binary executes; no daemon).

Verification

• Full make e2e-smoke locally: 76 passed, 3 skipped (live-forge tests)
• New unit tests: access-guard exemption (on/off), co-claimant note authorization, section map
• Repo-wide ruff + mypy clean

[github-actions]

Thanks for opening your first pull request on RoboCo!

Quick checklist before review (most of these are enforced by CI, but worth a glance):

• make quality — ruff format check, ruff check, mypy, pytest (≥80% coverage), and the rest of the gate
• Panel changes pass pnpm lint and pnpm exec tsc --noEmit (run from panel/)
• No # noqa / # type: ignore shortcuts; pre-existing violations in touched files are fixed
• Added an entry under ## [Unreleased] in CHANGELOG.md
• Signed the CLA (the bot will prompt you on this PR)
• Signed your commits — master requires verified signatures (SSH signing setup)
• Updated any affected docs under docs/

See CONTRIBUTING.md for the full workflow and the Code of Conduct for the community standards we follow.

Welcome aboard — a maintainer will review shortly.