refactor(tf): DDD refactor of the tf runner (phase 2, partial)

[grubmeshi]

Phase 2 — DDD refactor of the tf runner (partial)

Behavior-preserving DDD refactor of the tf runner under the green phase-1 characterization suite. Stacked on refactor/single-go-binary/phase-1-characterization-tests.

Gates (all green)

• task test (all 3 modules) — pass
• task test:tf-block-runner (go test -race) — pass (62s)
• task lint — 0 issues across all modules
• task coverage — tfrun 90.3% >= 90% gate
• All 3 modules build (go build ./...)

Landed (each an always-green checkpoint)

• Step 2 (D4) — meshcrypto.Crypto global eliminated. New Decryptor port (certDecryptor/NoopDecryptor/NewCertDecryptor) threaded through decryptIfSensitive, SshAuth.unwrapCert, DTO→Run mapping, RunApiClient, workers, manager and main. var Crypto deleted from go-meshapi-client/crypto (flagged cross-module edit per §10 — provably dead after this step; all modules build).
• Step 5 (P3) — RunContextInfo-in-context.Value smuggling removed. RunContextInfo passed as an explicit parameter to work/observer routines and Apply/Plan/DestroyCmd; contextKey/runInfoContextKey deleted.
• Step 6 (B10) — reporting data race fixed structurally. RunStatus.Steps []*StepStatus → []StepStatus (P4); mutex-guarded progress tracker (publish/setStatus/Snapshot with deep-copy clone) replaces the reportStatus shallow copy.
• B6 — DefaultRunManager.shutdownCalled → atomic.Bool.
• -race on for the tf leg (Taskfile + CI matrix test-flags), pulled forward from 2b to guard the B6/B10 structural fixes.

Sanctioned deltas (D13 exception, §5.5)

• B6/B10 fixed structurally in phase 2 — the only sanctioned in-phase-2 behavior change (a data race cannot be "preserved"; STOP-D). -race turned on early to lock them in.

Deferred within this slice (left green, no partial edits)

• Step 3 — kill ToInternalWithoutDecryption fork (STOP-B-adjacent: flips one internal-flag pin).
• Step 4 — AppConfig de-global (~20 read sites + ~14 test setups mutate the global).
• Steps 7–8 — Engine unification + Worker/SingleRunWorker collapse + step-pipeline unification.
• Steps 9–11 — internal/{tf,gitsource,tofu} split + util/ dissolution + depguard.

Exit criteria — status (partial)

• ✅ coverage gate ≥90 held (90.3%); meshcrypto.Crypto global eliminated; context.Value smuggling removed; B6/B10 races fixed under -race.
• ❌ NOT met: "one execution engine" (Steps 7–8 deferred); "polling and single-run are RunSource configurations" (Step 8 deferred); "no package-level mutable state" (AppConfig global remains, Step 4 deferred); package split (Steps 9–11 deferred).
• ⚠️ Runtime smokes NOT run (require a live stack / single-run binary env unavailable here): local-dev-stack polling run and EXECUTION_MODE=single-run binary smoke. main.go/NewManager/NewRunApi/single-run mapping wiring changed — run both before merge.

Uncertainties for human review

1. Phase incomplete vs plan exit criteria. The plan's 12-step sequence is only partially landed; the substantive engine unification (7–8) and config de-global (4) remain. Shipped the green subset per the always-green paramount constraint rather than a large unreviewable/unverifiable mega-diff.
2. Assumption A5 materially optimistic (plan-premise, human look warranted). Many phase-1 characterization tests are white-box (construct GenericTfCmd/RunContextInfo/TfCmdParams literals, smuggle rci into mock closures via ctx.Value, assert on internals) rather than black-box at the declared seams. This is why the remaining steps are heavier than the plan's "≤15 mechanical steps" premise. Under the STOP protocol this would halt for replanning; under the autonomous run it is recorded here.
3. -race scope. Enabled on the tf leg (test:tf-block-runner + CI), not the aggregate task test loop.

🤖 Generated with Claude Code

[grubmeshi]

Superseded by #65, which consolidates the plan + all phases 0→7 + the phase-3/5 remediation into a single reviewable PR (with all plan/run artifacts and a code-verified FOLLOW_UP.md). Closing in favor of #65.