chore: re-vendor guard-core spec 4.1.0 corpus regen v2 at engine 4.3.2

[rennf93]

Summary

Re-vendors the guard-core spec 4.1.0 corpus at engine 4.3.2 from the regenerated reference corpus (v2, Guard-Core/guard-core#151, engine commit 37b6a132). The v2 corpus is generated with the optional guard_agent module installed in the reference environment, so the round-1 zero-pin artifact is fully superseded.

Vendor changes (cases/ byte-identical to the reference export, diff -r clean)

• event_stream.json now pins 47 real envelopes across 38 non-empty cases (v1 pinned expected: [] for the bus-emitted scenarios because the generation environment lacked guard_agent)
• index.json: engine_commit, generated_at, and cost budget reference_ms jitter only

Ledger re-evaluation: php_events_xfail.json 29 entries -> 32

Every entry was re-evaluated against the real pins (fail-closed):

• 2 entries REMOVED as stale by policy: evt_country_blocked_geo and evt_geo_lookup_failed_download now reproduce the reference envelopes (the round-1 got-1-want-0 count divergences are gone against real pins)
• 5 entries RETURN under their documented port gaps, now real got-0-want-N divergences: evt_behavioral_violation_usage_log, evt_ip_unbanned, evt_path_excluded_health, evt_pattern_detected_xss, evt_security_bypass_all (round 1 had removed them only because the artifact pinned 0 envelopes; the port emits nothing and v2 pins real envelopes, so they fail again and need entries)
• the surviving 27 entries are RE-REASONED from the round-1 count-level artifact wording to the actual envelope divergence: missing handler-level emitters (sus_patterns, ip_ban, redis manager, csp report, route_unresolved, ip-extraction spoofing), pipeline block-mapping shapes (blockEventType defaulting to penetration_attempt, check-hook metadata, log-format reasons), and the trailing security_headers_applied envelope the port's pipeline emits and the reference does not
• php_pipeline_xfail.json (empty, fail-closed), php_redis_interop_xfail.json and php_safety_xfail.json unchanged: those gates re-ran green against the v2 corpus

Gate results (local, PHP 8.5 host mirroring CI's conformance invocations; the 8.2/8.3/8.4 matrix covers bin/test_support.php)

• detect: 193/193 passed
• pipeline: 35 passed, 0 failed
• pattern_safety: 69 passed, 25 xfail, 0 failed (unchanged from round 1: real pins did not move the safety ledger)
• events: 6 passed, 32 xfail, 1 advisory skip, 38 driven cases
• redis_interop: 7 passed, 7 xfail, 14 cases
• cost budgets: 9 workloads under self-relative ceilings

True divergences against real pins

All remaining events entries are documented port gaps in the PHP engine (missing emitter seams, pipeline block-mapping envelope shape, the extra trailing security_headers_applied envelope). None of them is a runner artifact: each reason names the port source responsible.