fix: 9.5-code reachable items (parse unification, goal branch, fail-open logs, M7 test, fingerprint)

Parse: agent_tools/tool_approvals column parsing unified into agent_def shared helpers (parse None = undeclared; server keeps None, worker maps to []/{} at _task_from_row, dispatch behaviour unchanged). Goal: _apply_resume_preamble goal branch proven reachable via _goal_convert_queued on a queued auto-resumed task, kept with a test and corrected docs (not dead code). Fail-open: audit write failure and preamble lookup failure now log warnings (best-effort unchanged); partial policy failure and shadow parse drops documented as known gaps. M7: shadow endpoint explicit_capability_failures_truncated test. Fingerprint: RoutingPolicy.content_fingerprint (canonical JSON sha256, version excluded) surfaced only in dry-run output, never in audit rows. M1 wording: legacy gap stated as fixed stock persisting per-task until completion, not converging.

cloud/routing_dryrun.py

@@ -118,6 +118,7 @@ def dry_run_policy_document(data, env_mode_override=None,
     if not isinstance(data, dict):
         return {
             "valid": False, "blocked": True, "version": None,
+            "content_fingerprint": None,
             "global_mode": None, "global_mode_source": None,
             "tiers": tiers_report, "dropped_tiers": dropped,
             "unknown_tiers": unknown,
@@ -141,6 +142,7 @@ def dry_run_policy_document(data, env_mode_override=None,
             "entirely and workers would keep the worker default")
         return {
             "valid": False, "blocked": True, "version": None,
+            "content_fingerprint": None,
             "global_mode": None, "global_mode_source": None,
             "tiers": tiers_report, "dropped_tiers": dropped,
             "unknown_tiers": unknown, "warnings": warnings,
@@ -311,7 +313,9 @@ def dry_run_policy_document(data, env_mode_override=None,
     blocked = bool(dropped or unknown or cap_blocked or _gw_blocked)
     return {
         "valid": True, "blocked": blocked,
-        "version": policy.version, "global_mode": global_mode,
+        "version": policy.version,
+        "content_fingerprint": policy.content_fingerprint(),
+        "global_mode": global_mode,
         "global_mode_source": global_source,
         "tiers": tiers_report, "dropped_tiers": dropped,
         "unknown_tiers": unknown, "warnings": warnings,