fix(builder): share Code failure policy with diagnosis

Reuse the existing repair policy inside the authoritative Code source context so diagnosis cannot prescribe grouping that violates the known invalid-record contract. Preserve source binding, privacy and omission budgets, and keep proposal vetting unchanged.

Validate actual diagnosis/proposal prompt delivery with six boundary cases and update the strict CI inventory. Focused tests: 373 passed. Ruff, scoped Pyrefly, diff checks and all seven exact guards passed. Independent audit: GO, 304 tests passed.

.github/scripts/builder-confirmed-tool-units.py

@@ -2930,6 +2930,7 @@ a4_expected.update(
             "test_diagnosis_does_not_expand_unbound_or_mismatched_source": 6,
             "test_diagnosis_expanded_source_redacts_credentials_and_excludes_neighbors": 1,
             "test_diagnosis_oversized_source_is_explicitly_omitted_without_a_prefix": 1,
+            "test_code_diagnosis_and_proposal_share_failure_policy_at_source_boundary": 6,
         },
         "tests.unit_tests.services.dify_builder.test_testdata_code_refresh": {
             "test_initial_file_submission_refreshes_low_risk_code_and_saves_inputs_once": 6,