[CMGS]

Whole-repo static audit of main 90cacf1. Every tracked file was read in full: sandboxd, silkd, boot/init, protocol/wire, the Go/Python SDKs and adapters, mcp, e2e, scripts, os-image, CI and docs. No correctness defects were found. The docs were cross-checked against the code: the config table, reload classes, API status codes, silkd verb limits and egress-lane restrictions all match.

Behavior change:

• config.ValidateVolumeCatalog now checks static volume tenants names against the tenant API syntax. A config holding an invalid name fails to load; it used to load and match no tenant. Runtime registration already ran this check and now shares the same code. The access-list doc and an Upgrading note are updated.

Changes (no behavior change):

• sandboxd/types/types.go: the unexported envView/namedVar now follow the exported vocabulary types.
• Test func types spelled twice now have names (routeFunc in mcp; the existing connHandler in sdk/go). managerEdit sits with the other test func types.
• protocol/wire/frame.go: responseHead is now the one spelling of the response tag head, used by EncodeResponse and respTagHead.
• outbound.Host.RearmTun returns for a claim without doors before resolving its policy. View/Resolve are side-effect free.
• Two e2e package docs are now one line each. A CI comment now names protocol/wire as the corpus test's home.

Gates were not run locally, by the owner's instruction for this round, so CI on this PR is the evidence.