[plan] jaahd: no credentialed or daemon-uid git ever reads

_Automatically composed from the parent epic at dispatch time._

Split by acceptance boundary: 4 independent coders in one phase "Isolation": mirror and denylist retirement, _native_run pin, image userinfo redaction, helper refusal. Acceptance tightened: the R1 cross-owner check is now a real test. AC-10 and AC-11 go to Finish.