fix(#20): heid-bug-hunt fixups — CLI open-world container-type hardening (slice-5)

Panel (Gróa + Hulda + Regin, source-verified by Heid): adapter/route-map/
ConnectFailed-at-call-sites sound against the declared invariants; 4 real
robustness findings, all in the CLI open-world presenter/probe paths — the
container-type layer BELOW the null/element holes the code-review already fixed.

Fixed (findings 1-3):
- `_format_whoami` (`cli.py`): a non-iterable `scopes`/`allowed_roles` scalar
  (`{"scopes": 123}`) made `x or []` yield `123` → `for s in 123` TypeError. New
  `_display_seq` helper degrades any non-list (scalar / bare string / null / absent)
  to empty; applied to both `scopes` and `allowed_roles`.
- `_characters_probe` (`cli.py`): same class on the model catalog `items` (`{"items":
  123}`) — now guards `models` is a Mapping and `items` is a list before iterating.
- `_characters_probe`: the top-level open-world reads `created` / `state` are now
  `isinstance(_, Mapping)`-guarded before any `.get` — a non-mapping SDK passthrough
  (`created=[...]`) aborts cleanly (exit 20) / renders `pad=None` instead of an
  AttributeError.

Accepted (finding 4, documented in contract § slice-5 notes): the `--characters`
probe leaks its transient character on a mid-lifecycle failure. PRE-EXISTING (the
retired probe had the identical linear no-`finally` structure — cutover did not
worsen it), TTL-bounded, one-shot diagnostic; a `try/finally` would swallow a
happy-path delete-failure (delete is both teardown and a tested step). Gróa + Heid
concur accept is defensible.

Dismissed (finding 5): Hulda flagged `sessions.py` dropping `get_me`/etc. as a
caller-contract break — it is the intended DEC-3 no-backwards-compat migration (all
in-repo callers rewired same-diff); Heid labels it intended-surface-change.

Added CLI tests for the three hardened paths (scalar scopes/roles; scalar items +
non-mapping state; non-mapping create abort). Suite 488 green; ruff clean; live
smoke re-run clean (identical happy-path output). Patch bump 0.21.17 → 0.21.18.

docs/contracts/worldtree_sdk_cutover.contract.md

@@ -274,6 +274,23 @@ re-anchor its coverage-map rows.
   is already hardened (slice-4 heid bug-hunt). The rewired `_characters_probe` extracts
   the created id defensively (`created.get("character_id")` + type-guard → clean abort,
   never a hard-index KeyError) since the create ACK is now an open-world SDK read.
+- **Container-type hardening (heid code-review + bug-hunt slice-5).** The degrade-not-
+  crash floor is guarded at THREE levels for the CLI presenters, not just one: (a) the
+  list-typed fields `scopes` / `allowed_roles` / model `items` degrade a non-list scalar
+  (`123`) or a bare string to empty via `_display_seq` / an `isinstance(_, list)` guard —
+  the older `or []` idiom only caught null/absent and would `for x in 123` `TypeError`;
+  (b) each element is type-guarded (`isinstance(m, dict)`); (c) the top-level open-world
+  reads `created` / `models` / `state` are `isinstance(_, Mapping)`-guarded before any
+  `.get` (a non-mapping passthrough would otherwise `AttributeError`). All three feed
+  `--whoami` / `--characters` only.
+- **Accepted (not fixed): the `--characters` probe leaks its transient character on a
+  mid-lifecycle failure.** create → get-state → delete runs linearly with no `finally`,
+  so a state/delete failure after a successful create orphans the probe character until
+  its TTL. This is PRE-EXISTING (the retired hand-rolled probe had the identical
+  structure — the cutover did not worsen it), TTL-bounded, and `--characters` is a
+  one-shot diagnostic smoke; a `try/finally` cleanup would also swallow a happy-path
+  delete-failure (delete is both the teardown AND a tested lifecycle step). Accepted as
+  known-risk per the heid bug-hunt (Gróa + Heid concur accept is defensible).
 - **CLI-only rewire.** `me` / `capabilities` / `characters` / `models` have NO
   web-server caller — only the `--whoami` and `--characters` CLI one-shot probes. The
   web surface is untouched this slice.