[KayzenRoot]

Fix UADS fail-closed dispatch for infrastructure/kernel Work Orders such as Hive Forge M00.

Changes:

• add bounded domains: rust, kernel-runtime, contracts, event-driven-systems, state-recovery, offline-first, testing, certification;
• add systems-runtime-specialist and host agent descriptor;
• let test-engineer cover testing and independent-reviewer cover certification;
• classify foundational runtime/recovery/certification work as HIGH risk;
• classify kernel/runtime and state-recovery + offline-first work as architectural;
• add contract/recovery gates for relevant systems domains;
• add regression tests reproducing the eight-domain Forge M00 routing case;
• preserve fail-closed behavior for genuinely unknown domains.

This patch does not bypass independent review, security gates, or host capability checks. It fixes missing legitimate coverage and prevents foundational work from being under-classified.