fix: keep ci gate clean-checkout safe

[MiaoDX]

Summary

• mark private B1 / Agibot / submodule-content tests as local before directory layer classification
• exclude local tests from the fast CI gate
• isolate runtime inventory unit tests from unrelated live host ports while preserving default production probing

Root cause

Local verification was not equivalent to GitHub Actions. The workstation checkout has private B1/Agibot assets and live host state, while Actions checks out without submodule contents or local private data. Some private-asset tests were still classified as contract because the directory layer won before the new local checks. Two operator-console tests also read the real default MCP port and changed result based on whatever was running locally.

Verification

• just agent::verify ci-required
• no-submodule clean clone with fresh .venv: uv sync --extra dev && just agent::verify ci-required