test: Add 25 WRAP_ACTIONS conformance fixtures for coverage gaps

[leongdl]

Summary

25 WRAP_ACTIONS fixtures closing gaps identified by a systematic coverage audit of RFC 0008 against the existing suite. All 25 validated individually through the conformance runner against openjd-rs; full suite goes 72 → 97 passing, 0 failing.

Areas covered

• Absent-by-design (new coverage class): host-inherited variables (HOME, PATH, OPENJD_*) must NOT appear in WrappedAction.Environment — pinned with expected.forbidden. Previously a runtime forwarding os.environ wholesale passed every fixture.
• Macro × emitter matrix: openjd_env emitted by the wrap script itself; by a task grand-child and visible in the next task's WrappedAction.Environment; by a grand-child under onWrapEnvExit; openjd_progress/openjd_status forwarding; stderr forwarding; and the negative control that a wrap script discarding grand-child stdout loses the macro (pins "MUST NOT scan the grand-child directly").
• Variable scope negatives: WrappedEnv.Name in onWrapTaskRun rejected; WrappedStep.Name in both env hooks rejected; out-of-scope WrappedAction.* buried inside an EXPR function call and inside a let binding — a validator that only walks format strings passes the pre-existing negative and misses these.
• All-or-nothing rule: the four previously untested invalid hook subsets (enter-only, exit-only, enter+exit, run+exit).
• Nesting depth 2: two inner envs, WrappedEnv.Name correct per invocation.
• Nothing-to-replace: a variables:-only inner environment (no script at all) runs no wrap hooks — named in the RFC and schema constraint 5, previously untested.
• Failure-path breadth: failed onWrapEnvExit → wrapping env's own onExit still runs; grand-child failure under the enter hook propagates; unwrapped-parity control.
• Positive twin: FEATURE_BUNDLE_1-gated format-string timeout and cancelation.mode on wrap hooks accepted when the extension IS listed (only the reject side existed).

Verification

Every fixture executed via run_openjd_cli_tests.py against openjd-rs. Negatives verified to reject for the exact RFC 0008 rule under test (not an incidental reason). Cross-platform via python -c; no new runOn gates.

Companion PR

Spec-correct fixtures that FAIL against current implementations are in a separate expected-failures PR (branch conformance-wrap-actions-expected-failures) so this one merges green.

[leongdl]

CI note: two fixtures fail on CI but passed local validation against openjd-rs main (wrap-failed-exit-hook-own-onexit-still-runs, wrap-grand-child-fails-under-enter-hook) — likely a released-vs-main CLI version difference or Linux/macOS platform difference; investigating before marking ready. Mainline CI is also currently red for every PR due to two pre-existing broken fixtures unrelated to this change.