shell→dag §5.A/§5.B: dissolve hostname-short read into typed os.Hostname.ReadShort op

[gunbai-bot]

shell→dag §5.A/§5.B: dissolve the hostname-short read into a typed op

Continues the shell→dag arc (census docs/plans/shell-to-dag-residual-census-and-arc-completion.md) following the merged exemplar #7064. Adds the first of the census §5.A new ops and dissolves both runtime-present hostname -s read consumers — the concat is deleted, not relocated (the regression #7004/#7006 warned about).

What lands

• New dag/extdeps/os/hostname.dag — cited service os.Hostname operation ReadShort (["hostname","-s"], readonly, mock_response). The old "hostname -s 2>/dev/null || hostname" absorbing fallback (§5 — silently substitutes the FQDN when -s fails, conflating short vs long) becomes a typed exit outcome: nonzero => refuse, never re-appended.
• New dag/gunbc/hostname_read.dag — typed reader mirroring the merged systemctl_show_read: LocalShell → the typed op; SshShell → typed argv through typed_argv_exec (not a joined string); EmitArtifactThenThinRun → none. Plus an argv-matches-authority consistency fn.
• host_effect_realize.dag — new typed cell HostnameReadOnHost; HostIdentityShortHostnameRead now resolves to it instead of ShellOnHost { script }; realize_hostname_read_on_host grounds ShellEffectApplied. All three total folds (apply, apply_gated, not_converged_directive) get the arm — fail-closed by construction.
• Deleted dag/gunbc/host_identity_observation_script.dag (the concat + its scaffold).
• ci_deploy_target_host.dag — the runtime-present deploy_target_host_observed_hostname() reads through the typed op. The GHA preflight block (foreign-executor run:) legitimately stays shell (category E — bounded roster).

Green by execution (hermetic)

• PASS host_identity_observation_holds — new witness_hostname_read_argv_is_typed_not_concat (materialized argv == hostname -s, matches authority), witness_hostname_read_resolves_typed_cell_not_shell_script (the discriminating RED: resolve → HostnameReadOnHost, not ShellOnHost — goes red on any revert to a string sink), and witness_host_effect_apply_hostname_read_converges (end-to-end via the mock).
• PASS ci_deploy_target_host_witnesses — new witness_observed_hostname_reads_typed_op_hermetic.

The string-pinning witness_hostname_script_is_modeled_constant (which enshrined the concat as the contract — the anti-pattern the census flags) is replaced.

Scope / not in this PR

• os.Hostname.SetHostname + the SetHostnameCas host_effect_set_hostname_cas_script concat (§4.A2 model-first) — a follow-up reusing this op file.
• program.dag/serialize_bash ratchet untouched (this touches no bash-AST vocab).

🤖 Generated with Claude Code