test(#754): pin the missing no-holder-fallback regression + comment cleanup

[Weegy]

Summary

Closes #754. The scope was almost entirely already delivered by #333 Phase 3 (PR #726) — this PR
finds and fills the one gap: the second mandatory regression test the issue calls out, plus a
stale comment.

What #726 already shipped (verified, not re-designed)

• middleware/packages/harness-channel-sdk/src/roleHolderSource.ts — RoleHolderSource,
  RoleHolderRegistry, AggregateHolderLookup with the resolved | unavailable + partial
  discipline the issue requires (never a bare string[]).
• middleware/src/conductor/roleHolderResolver.ts — wires ConductorRoleStore in as the
  'conductor-local' source, buildRoleHolderRegistry(), and holdersOnly() for the
  call sites that may legitimately degrade (operator inbox, reminder nudger).
• middleware/src/conductor/index.ts — already builds the registry
  (buildRoleHolderRegistry(roleStore, deps.roleHolderSources ?? [])) and threads it into both
  RunExecutor (resolveRoleHolders) and the await worker (holdersOnly(...)).
• middleware/src/conductor/runExecutor.ts:
  • resolveAwait's quorum='all' completeness check already refuses to close on a partial
    holder list, even if every currently-known holder responded.
  • openHumanAwait's "role has no holder → take the fallback" already only fires on a
    resolved-empty lookup; a partial-empty lookup parks instead (the run reaches the same
    fallback later via its deadline, but only after the real holders had a chance to answer).

I verified this by reading roleHolderResolver.ts/runExecutor.ts end to end before touching
anything — the "check whether wiring is the entire remaining scope" the issue asks for. It is.

What was missing

Of the issue's two mandatory regression tests:

1. quorum='all' non-completion on partial/unavailable — already existed
   (conductorQuorumAndTimeout.test.ts:127, from feat(#333): role sources + pluggable role→holder resolution (phases 2 and 3) #726), with a same-inputs partial:false
   control right below it.
2. "no holder → fallback" firing only on resolved-empty, never on unavailable — had no
   test. openHumanAwait's fail-closed branch was implemented but unexercised.

Added the missing pair in middleware/test/conductorQuorumAndTimeout.test.ts (new describe
block, same minimal-fake-harness pattern as the existing quorum tests, driven through the public
ConductorRunExecutor.startRun):

• a RESOLVED empty holder list takes the fallback path — records the step 'failed' with
  actor: { kind: 'human', noHolder: true }, opens zero awaits.
• an UNAVAILABLE (partial) holder lookup does not take the fallback — it parks (opens an
  await, calls runStore.park) exactly as if a real, not-yet-answered holder existed.

Also updated the roleStore.ts:22 comment (issue requirement #5): it still described the
external-resolver seam as future work after #726 had already filled it.

Blast radius

• middleware/src/conductor/roleStore.ts — comment-only change (no behavior change).
• middleware/test/conductorQuorumAndTimeout.test.ts — additive; no existing test modified.
• No production code paths changed. No migration needed — no schema change.
• Untouched (per scope guardrails): credentials/ namespaces, src/index.ts.

Test + mutation evidence

• npx tsx --test test/conductorQuorumAndTimeout.test.ts — 9/9 pass (4 suites).
• npx tsx --test test/conductor*.ts (full conductor suite) — 229/229 pass (58 suites).
• npx tsx --test test/roleHolderSource.test.ts test/roleSource.test.ts test/conductorCancelAndStrictApproval.test.ts test/conductorReminders.test.ts test/conductorRunExecutorNotifyRunEnded.test.ts — 59/59 pass.
• npm run build — clean.
• npm run typecheck:test — ratchet unchanged (371 known errors, baseline 371, no regressions).
• Mutation check: reverted each fail-closed guard in runExecutor.ts one at a time against a
  clean rebuild —
  • removing the partial branch in openHumanAwait → new test chore(deps,ci): Bump docker/metadata-action from 5 to 6 #2 (unavailable → no fallback)
    goes red.
  • dropping the !holdersPartial conjunct from the quorum='all' completeness check → the
    pre-existing feat(#333): role sources + pluggable role→holder resolution (phases 2 and 3) #726 test goes red.
    Restored both, rebuilt, reran — clean diff, 9/9 green again.

Open questions

None — the scope really was "wiring is already the entire remaining work," confirmed before
writing anything new, per the issue's own instruction.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}