refactor(build): centralize the build gate graph in xtask

[slepp]

Summary

Build and CI entry points now derive gate dependencies, required tools, platform setup, and timeout policy from xtask. The Makefile remains a thin facade, while compiled Hew test caching preserves identities, successful verdicts, and failure evidence across fixture changes. Review the gate dependency graph and the cache invalidation boundaries.

Verification

• cargo test --workspace --no-run: workspace test targets compile
• cargo xtask gate cutover-contract: cutover and timeout contracts pass
• cargo xtask gate freebsd-contract: centralized FreeBSD setup contract passes
• cargo xtask tools --gates ci --field tools: the selected gate set resolves its required tools

Out of scope

• Workflow lint and local workflow runner provisioning remain in a dependent change.

[slepp]

I do not think this branch is safe to land as-is. The first deterministic failure is the sandbox parity contract: the Makefile no longer exposes the recipe shape the check requires, and the Linux preflight also reports four failed commands. Current main has since changed the preflight dispatcher in #2944 and hardened tool provisioning in #2927, while this branch conflicts across a 186-file, 72k-line build rewrite. With the dotted-path cutover imminent, I recommend restating only the still-wanted build changes as fresh, bounded PRs rather than attempting a wholesale rebase.