* fix(verifiers): retain native cleanup ownership on failure
* fix(verification): load cleanup fixtures through the module resolver
CodeQL's local threat model treats file contents passed to
vm.SourceTextModule as user-controlled code execution. Import the real
verifier modules and redirect their dependencies to static mocks instead
of compiling script text read from disk.
* fix(verifiers): own CLI and MCP process families
* fix(verifiers): retire workspaces after cleanup retry
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
