feat(orchestrator): M4 失败隔离 + P-guard 确认(SC-11/12)

SC-12 失败隔离:单 task 失败不再拖垮整个 run。
- refresh_swarm_run_status:next_status 仅在"有失败且无任何完成产物"时 failed;
  有完成工作则走 completed,交蜂后/convergence 判定(失败仍由 termination_reason 反映)。
- 解决那次 LLM 网关 404 致单 task 失败 → 整 run FAILED 的单点问题。

SC-11 P-guard:guard.diagnose 已由 assess_swarm_health 在派发循环接入(探索确认,零改动);
检测无 Agent/无模型/依赖死锁/预算耗尽/种子不可分解。

全套测试通过:runtime-contract / merge-smoke / workflow-e2e / contract-freeze
+ task-competition / queen / run-isolation。

影响:仅 orchestrator 终态判定;Manager status 映射不变(failed/completed)。

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

orchestrator/main.py

@@ -678,7 +678,13 @@ async def refresh_swarm_run_status(run):
                 await swarm_runtime.save_run(run)
             return
 
-    next_status = "failed" if any(task.status == TaskStatus.FAILED for task in tasks) else "completed"
+    # Failure isolation (SC-12): a single failed task must NOT sink the whole run (e.g. one task
+    # tripped a transient LLM-gateway 404). Declare the run failed ONLY when there is no completed
+    # work to deliver; otherwise take the completed path and let the Queen / convergence judge
+    # acceptability (the failure is still surfaced in convergence termination_reason).
+    failed_tasks = [t for t in tasks if t.status == TaskStatus.FAILED]
+    completed_tasks = [t for t in tasks if t.status == TaskStatus.COMPLETED]
+    next_status = "failed" if (failed_tasks and not completed_tasks) else "completed"
 
     # Master review-and-iterate gate: before declaring success, optionally run the critic and
     # send rejected work back to the specialists. Off unless ENABLE_REVIEW_LOOP is set, so the