- move runtime policy/diag contracts to domain-owned facade and remove control_plane leapfrog usage
- enforce single declaration point for direct debug config in domain public API (constraint #6)
- harden timeout/idempotent semantics in REST/voice/printer/wifi/ble paths