fix(rpiv-pi): contain reconcile/citation paths to cwd; settle late parks on retired lanes

Resolve-then-contain (new containedPath in built-ins/shared): reconcile
directives and citation resolution now reject absolute or ..-escaping
targets on the RESOLVED path — the suffix allowlist and citation charset
checked a different string than the fs sinks used, so an out-of-tree
*.test.ts target could be written and an existing out-of-cwd file read
as a backed citation. Escapes are findings now, fail-closed.

enqueueInput status-gates: a park on a missing OR non-running lane
settles the resolver with undefined immediately — a late relay park
racing the x-key abort could land after retireRun's only settle pass
and strand (first-retire-wins), pinning the needs-input clock and the
warp Blocked badge until manual evict/answer.

Also pins the exact CMD_USAGE_PREVIEW string in rpiv-workflow's
preview.test.ts (prior assertions passed under any gap width).