fix(automation): run green unit baseline

[mkczarkowski]

What changed

• runs the bounded loop against the green root unit-test suite instead of recursively including build-dependent smoke/E2E files
• keeps external network denied while allowing loopback-only HTTP fixtures
• requires a zero-failure baseline and zero-failure candidate gate
• refreshes the generated repository map

Root cause

The first real launch after #11 merged failed closed during baseline capture. bun test recursively included build-dependent suites, while the all-network-denied sandbox also prevented the local HTTP fixture from binding. That produced 12 failures instead of the assumed 8, including duplicate (unnamed) failures, so baseline pinning stopped before any Codex iteration ran.

Safety impact

This makes the unattended lint loop stricter: the root unit suite must remain fully green (469 pass / 0 fail). Codex still has no network access. Outer gates can use loopback for local fixtures, but an explicit external HTTPS probe remains blocked.

Validation

• bun test tests/night-loop.test.ts — 12 pass / 0 fail
• bun run typecheck
• bun run lint — 2 pinned warnings / 0 errors
• networkless root unit gate — 469 pass / 0 fail
• external HTTPS probe under the gate profile — blocked
• bun run build
• bun run examples:catalog:check
• bun run repo-map:check

No agent iteration or automation PR was created by the failed launch.