fix(review): land the adversarial findings — a11y reason, kernel-lane boundary, probe hardening

The privileged kernel lane's landlock boundary test used a /tmp write as its
DENIED arm — the exact write this branch's floor now allows, so the lane would
have graded the fix as a violation. The denied target moves to /var/tmp
(world-writable at the DAC layer, on no landlock rule list), and the test gains
a floor arm: a /tmp write must now SUCCEED, which proves the shared grant on a
real kernel rather than on the list tests alone. Found by the cross-model
review pass.

Cordon and Drain's disabled reason rode a title attribute on a natively
disabled button — mouse-only, never announced, dead to keyboard and touch. They
render through TooltipButton now, the design-system primitive built for
disabled-with-reason.

The probe's scratch file is pid-unique and O_EXCL: under dev_none the probe
runs on the HOST /tmp, where a fixed non-exclusive name could follow a planted
symlink or race a concurrent probe. The scratch key also joins the probe/parser
round-trip pin and the unit fixtures (pass, refused, absent-key fail-closed),
so a one-sided key rename can no longer hide behind the integration lane's
Linux gate.

Smaller findings from the same pass: the checks panel copy finishes the rename
("Never checked", "Checks are outstanding"); the tokenizer's connective branch
is gone — a bare `and` was already dropped by construction, so the branch was
dead code and the tests now pin the behavior instead; the filter's renamed
copy is pinned as literals; inert size props on Button-inner icons are dropped
(the design system's [&_svg]:size-4 always won); the landlock list test sheds
the arm the comptime assert already enforces; a doc comment displaced by the
scratch insertion sits back above nameResolves.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>