Resolves three review comments on PR #1886:
1. **WorkspaceGuard (P1)** — tightened to require `dependsOn`. The engine's
`collectSiblingArtifacts` walks `dependsOn` transitively and nothing
else; routes references and positional neighbors don't seed the BFS, so
a stage that passed the guard via `hasPriorStage` or `hasRouteRefs`
alone would silently receive an empty artifacts object at runtime.
2. **anyFailed → any_failed (P2)** — added a dedicated `any_failed` leaf to
the DSL that checks `status === "failed"` specifically. The previous
`not(all_pass)` bridge would have (incorrectly) fired for `skipped` /
`outdated` stages too, since `isStagePassing` returns false for those.
v1.1's semantics required `status === "failed"`; the dedicated leaf
preserves it exactly. The reviewer's suggested fix had the same bug —
`or(not(all_pass([s])))` is semantically identical to `not(all_pass)`.
3. **Key-order deep-equal (P2)** — replaced `JSON.stringify` comparator in
config-diff.ts with a recursive deep-equal that sorts keys at every
object level. A YAML reformatter reordering `executor.config` keys
(`{tone,depth}` → `{depth,tone}`) would otherwise stringify to
different strings and falsely classify the diff as structural,
aborting an in-flight run for a no-op edit.
Tests updated to reflect the tightened workspace guard; new tests for
`any_failed` semantics and key-order independence. 1374/1374 passing.
76ced8ca4a