fix(engine,cli): forbidden-import predicate boundaries, coverage gaps, strict-contract status, toolchain pin (#106)