Fix interrupted rollout projection and run reporting

[ToussaintKnight]

What changed

• Treat desktop-projection compatibility as part of rollout health.
• Detect and quarantine legacy abort events that lack native completion metadata.
• Repair stale and legacy aborts with an associated <turn_aborted> marker, reason: interrupted, numeric completed_at, and numeric duration_ms.
• Preserve the explicit placeholder for interrupted tool output instead of fabricating the original result.
• Publish the current synchronization result in the same device report and rewrite it as failed if transport finalization fails.
• Add a regression fixture for an already-present legacy malformed abort.

Root cause

The previous semantic audit treated any turn_aborted event as a valid closure. Codex desktop projection requires a stricter native event shape, so Sync2 could report a healthy rollout while the UI continued to show the old turn as inProgress. Device reports were also written before the current run record, causing a one-run observability lag.

User impact

Recovered tasks now project correctly after restart, unsafe snapshots remain quarantined, and fleet health reports describe the run that produced them.

Validation

• npm test — 65 checks passed
• node --check scripts/sync2.mjs
• Sync2 skill validation passed
• git diff --check
• Private-data/secret/path scan returned zero findings

Privacy

All fixtures use synthetic IDs and temporary directories. No conversation content, vault data, local usernames, IP addresses, device IDs, credentials, or databases are included.

Closes #1

[ToussaintKnight]

CI follow-up: Ubuntu exposed a test-harness assumption, not a production failure. The scheduler preview test now validates installation on Windows/macOS and explicitly validates the unsupported-platform contract on Linux. The full 65-check suite still passes locally on Windows.