fix: clarify expand directive fulfillment for reflex workers

[christopherjnelson]

An expand worker at its open target receives an at-target progress label, but arrival does not fulfill its directive. Make the existing authoritative completion rule explicit: the target must be infected and controlled by that worker.

Jev's expand context now states the fulfillment condition and explains the positional progress label. The infection candidate at the assigned open target explains that infection establishes worker control and fulfills expansion. All legal choices, including wait, remain available. Zero's risk assignments, probability validation, replan thresholds, planner cadence, action mapping, and engine completion rules are unchanged. No export schema change is needed.

Focused offline tests cover context across risk tolerances, assigned-target versus off-target descriptions, unchanged legal choices, authoritative arrival/wait/infection completion, and valid wait selection through individual and native-batch paths. Architecture, security, testing, and roadmap documentation are updated. A fresh reviewer found no actionable issues.

Validation on commit 700b8f9:

• pnpm install --frozen-lockfile
• pnpm validate — formatting, lint, types, 278 tests, and builds
• pnpm test:e2e --config /tmp/hexzero-expand-clarification-playwright.config.mts — the full repository suite: all 3 Chromium tests, using 3 workers

The existing owner API on 8787 and frontend on 3000 were preserved. The temporary Playwright config imports the repository config and retains test selection, Chromium device settings, parallelism, retries, tracing, assertions, and server timeouts/reuse settings. Temporary application copies were byte-checked against the commit: only the World Lab rewrite port (8787 → 8891) and API CORS ports (3000 → 3111) differed. The API remained scripted, frontend used 3111, and no request interception override was enabled. The initial isolated attempt exposed the omitted CORS port adjustment; the corrected setup passed before commit and was rerun for final validation on the commit. Temporary copies are excluded from this PR.

No paid-provider calls. The next owner-run 25-tick scenario should compare open-target infection/wait rates within each risk-tolerance category, captures, and territory growth. One live run supplies observational evidence, not proof of causation.