chore: prepare 1.3 cleanup on restored main

[ebursztein]

Summary

• preserves the repaired main history while applying the trusted 1.3 cleanup tree
• removes the retired PolicyCallback/callback event-type rail so SecurityEvent uses RuntimeSecurityEventType directly
• deletes stale positive Policy V2 E2E tests and keeps stale event strings only in rejection tests
• updates security action benchmarks to exercise SecurityRuleSet/plugin paths

Verification

• cargo check -p capsem-core --no-default-features
• cargo check -p capsem-service --no-default-features
• cargo test -p capsem-core --no-default-features security_event --lib
• cargo test -p capsem-logger --no-default-features security_rule --lib
• cargo test -p capsem-service --no-default-features --lib
• cargo test -p capsem-core --no-default-features --lib
• cargo test -p capsem-logger --no-default-features --lib
• cargo check -p capsem-core --no-default-features --bench security_actions

Notes

The first commit is a merge-style snapshot: parent one is repaired origin/main, parent two is release/1.3-cleanup-pr, and the tree starts from the trusted cleanup branch. The follow-up burn pass removes the stale callback event identity layer instead of preserving compatibility.

[codecov-commenter]

Codecov Report

❌ Patch coverage is 77.27113% with 648 lines in your changes missing coverage. Please review.
⚠️ Please upload report for BASE (main@ef5b2b2). Learn more about missing BASE report.
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
crates/capsem-core/src/mcp/server_manager.rs	48.4%	107 Missing and 11 partials ⚠️
crates/capsem-core/src/net/mitm_proxy/mcp_frame.rs	0.0%	70 Missing ⚠️
crates/capsem-core/src/credential_broker.rs	80.1%	34 Missing and 28 partials ⚠️
crates/capsem-agent/src/mcp_server.rs	48.9%	41 Missing and 8 partials ⚠️
crates/capsem-core/src/net/policy_config/types.rs	66.9%	28 Missing and 9 partials ⚠️
crates/capsem-gateway/src/terminal.rs	77.3%	30 Missing and 4 partials ⚠️
crates/capsem-core/src/net/ai_traffic/events.rs	82.5%	18 Missing and 10 partials ⚠️
crates/capsem-core/src/security_engine/mod.rs	79.5%	13 Missing and 14 partials ⚠️
...sem-core/src/net/policy_config/profile_contract.rs	86.8%	4 Missing and 21 partials ⚠️
crates/capsem-core/src/fs_monitor.rs	81.4%	18 Missing and 3 partials ⚠️
... and 22 more

Additional details and impacted files

@@          Coverage Diff           @@
##             main     #68   +/-   ##
======================================
  Coverage        ?   69.3%           
======================================
  Files           ?     201           
  Lines           ?   70938           
  Branches        ?   67837           
======================================
  Hits            ?   49200           
  Misses          ?   19421           
  Partials        ?    2317           

Flag	Coverage Δ
integration	16.8% <15.2%> (?)
linux-unit	68.9% <77.1%> (?)
unit	69.0% <77.1%> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

Components	Coverage Δ
Network	89.1% <83.6%> (?)
Security	81.9% <79.6%> (?)
Tooling	76.1% <61.3%> (?)
Monitoring	83.4% <ø> (?)
Virtualization	71.6% <86.9%> (?)
Runtime	60.9% <57.6%> (?)
Daemon	64.7% <ø> (?)
Service	51.7% <ø> (?)
Admin	77.4% <91.5%> (?)
CLI	43.8% <ø> (?)
MCP Server	22.0% <ø> (?)
Gateway	86.7% <80.2%> (?)
TUI	66.6% <ø> (?)
System Tray	72.6% <ø> (?)
Guard	90.4% <ø> (?)
UI	74.2% <ø> (?)
Builder	90.1% <ø> (?)
Mock Server	∅ <ø> (?)

Files with missing lines	Coverage Δ
crates/capsem-app/src/main.rs	64.7% <ø> (ø)
crates/capsem-core/src/asset_manager.rs	83.0% <100.0%> (ø)
crates/capsem-core/src/auto_snapshot.rs	80.9% <100.0%> (ø)
crates/capsem-core/src/bin/mcp_export.rs	0.0% <ø> (ø)
...ates/capsem-core/src/hypervisor/apple_vz/serial.rs	90.5% <ø> (ø)
...rates/capsem-core/src/hypervisor/kvm/checkpoint.rs	87.1% <100.0%> (ø)
crates/capsem-core/src/hypervisor/kvm/vcpu.rs	72.6% <100.0%> (ø)
crates/capsem-core/src/mcp/mod.rs	71.0% <100.0%> (ø)
crates/capsem-core/src/mcp/policy.rs	71.4% <ø> (ø)
crates/capsem-core/src/net/ai_traffic/pricing.rs	97.0% <100.0%> (ø)
... and 80 more

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.