feat(taint): stage 1 of argument provenance — the tap records hosts fetched content named

The "derived from untrusted content" half of ActGov's invariant (no outbound
action whose target came from untrusted content). Observed only; no rule
reads it yet.

- the tap runs a node extractor only when a payload could be a fetch
  (WebFetch, WebSearch, curl/wget in command position) and appends the
  response's URL hosts, minus the agent's own target, to
  untrusted-hosts.txt beside the tap — a path hook-files already protects
- capped at 500, deduplicated, and the tap still always exits 0
- both tiers drain it per finished phase into a taint.hosts event
- shell-tested against the generated hook with the real node; the test caught
  `grep -r curl docs` being read as a fetch

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

crates/cm-api/src/microvm_turn_executor.rs

@@ -433,6 +433,7 @@ mod tests {
             rootfs: None,
             cli_version: None,
             tool_gate: None,
+            taint_hosts: Vec::new(),
             })
         }
     }
@@ -631,6 +632,7 @@ mod tests {
             rootfs: None,
             cli_version: None,
             tool_gate: None,
+            taint_hosts: Vec::new(),
                 })
             }
         }
@@ -666,6 +668,7 @@ mod tests {
             rootfs: None,
             cli_version: None,
             tool_gate: None,
+            taint_hosts: Vec::new(),
                 })
             }
         }
@@ -696,6 +699,7 @@ mod tests {
             rootfs: None,
             cli_version: None,
             tool_gate: None,
+            taint_hosts: Vec::new(),
                 })
             }
         }