#1054 First CI runs with submodules: mypy ratchet regressions (132 vs 118) and engine secret-owner test under root without CAP_DAC_OVERRIDE

EARS SPEC: - When the mypy ratchet finds a file over its baseline, the ratchet shall print every mypy error line for that file, so CI logs name each regression. - The highway tests job shall pass the mypy ratchet with no file over its baseline, and the baseline shall not be raised to absorb new errors; regressions are fixed in code. - When a file's mypy count drops below its baseline, the baseline entry shall be lowered to the new count (logs_activities.py 5->4, mcp_client/__init__.py 5->2, storage_service_uploads.py 5->4). - If the CI process is root without CAP_DAC_OVERRIDE, then test_file_owned_by_another_user_is_refused shall still reach the ownership check and see 'not owned by uid'. - read_platform_secret_file shall keep checking ownership with fstat on the opened descriptor (no stat-before-open). EVIDENCE (red): pipeline 3806 job 13872 'mypy ratchet: 132 errors in 54 files now, baseline 118 in 46 files: FAIL'; pipeline 3807 job 13874 '1 failed, 921 passed, 5 skipped', expected 'not owned by uid', got 'cannot be opened: PermissionError'. SYNTHESIS: localised CI/test fix, no new component. Domain: POSIX discretionary access control. Root without CAP_DAC_OVERRIDE reads a foreign-owned file only through the 'other' permission bits, so the test makes the foreign-owned file other-readable; the uid check runs before the mode check, so the ownership error is reported. Rejected: stat-before-open in the reader (ci-conductor option 1) because it reopens a TOCTOU window; skipping the test under root (option 2) because CI is the only place it runs as root and it would never be exercised there.