ci(pr-proof): isolate case PTY allocation (#1635)

* ci(pr-proof): allow isolated PTY allocation

* ci(pr-proof): isolate case PTYs

* chore(trail): record private devpts hardening

* test(pr-proof): gate trusted runtime coverage

* chore(trail): record proof runtime test gating

* test(pr-proof): verify privileged runner access

* chore(trail): record runner capability fix

* test(pr-proof): probe exact sandbox launcher

* chore(trail): record exact launcher proof

* fix(pr-proof): bind private ptmx on Linux

* chore(trail): record ptmx host compatibility

* test(pr-proof): detach launcher capability probe

* chore(trail): record detached launcher proof

* chore(trail): repair detached launcher trace

---------

Co-authored-by: Proactive Runtime Bot <agent@agent-relay.com>