fix(testing): reconcile ORCH-116 with merged ORCH-123 (ADR renumber, CHANGELOG, env parity)

Recovery from the merge-gate rebase-conflict bounce. The feature branch was
rebased onto origin/main (which had merged ORCH-123). The single conflicting
hunk — docs/architecture/README.md — was resolved during the rebase: kept
ORCH-123's host-side staging-runner line AND the ORCH-116 test-runner bullet.

This follow-up commit reconciles the remainder:

- Renumber the global sweeping ADR adr-0049 -> adr-0050. ORCH-123 took adr-0049
  (adr-0049-host-side-docker-execution-boundary.md) on main while ORCH-116 was
  in flight, so ORCH-116 yields to the merged task and moves to the next free
  number. Mechanical cross-reference reconciliation only (git mv + title + every
  test-runner reference across README/internals/CLAUDE/CHANGELOG/config.py +
  06-adr/ADR-001 + 12-review). Main's adr-0049 host-side references are left
  byte-for-byte untouched. No design/verdict content was altered.
- Restore the ORCH-116 CHANGELOG entry that the CHANGELOG auto-merge silently
  dropped (both ORCH-123 and ORCH-116 inserted at the same [Unreleased] anchor;
  git kept only ORCH-123).
- Add the missing ORCH_TEST_RUNNER_* keys to .env.example (parity with the
  ORCH_STAGING_RUNNER_* block; ORCH-101 canon of start keys).

Refs: ORCH-116

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.env.example

@@ -585,6 +585,34 @@ ORCH_STAGING_RUNNER_INFRA_MAX_RETRIES=2
 ORCH_STAGING_RUNNER_INFRA_RETRY_DELAY_S=30
 ORCH_STAGING_RUNNER_EXEC_HOST_SIDE=true
 
+# ORCH-116: deterministic test-runner replacing the LLM `tester` agent on the
+# `testing` stage for the self-hosting orchestrator (2nd determinization slice,
+# mirror of the ORCH-115 staging-runner). A leaf src/test_runner.py is intercepted
+# in launch_job BEFORE _spawn: it runs the SAME regression `python -m pytest <target>`
+# in the task worktree (+ optional read-only smoke), maps the exit-code -> result:
+# PASS|FAIL, writes 13-test-report.md and initiates the UNCHANGED check_tests_passed
+# gate. Replaces only the producer of the artifact; the gate / STAGE_TRANSITIONS / DB
+# schema are byte-for-byte unchanged. See ADR-001-deterministic-test-runner.md / adr-0050.
+#   TEST_RUNNER_ENABLED            -> kill-switch; false -> the prior LLM tester runs on
+#                                     testing via _spawn 1:1.
+#   TEST_RUNNER_REPOS              -> CSV scope; empty -> self-hosting only. A repo with
+#                                     no resolvable test-contract is never intercepted (BR-9).
+#   TEST_RUNNER_TARGET            -> pytest target of the test-contract (default tests/).
+#   TEST_RUNNER_TIMEOUT_S          -> wall-clock budget for the pytest regression
+#                                     (malformed/non-positive -> default 900 + WARNING).
+#   TEST_RUNNER_SMOKE_ENABLED      -> optional read-only smoke (/health,/status,/queue +
+#                                     serial_gate block); false -> pytest exit-code is the sole signal.
+#   TEST_RUNNER_INFRA_MAX_RETRIES  -> tool-error (suite did NOT execute) bounded DEFER
+#                                     budget before a fail-closed FAIL (anti ORCH-110).
+#   TEST_RUNNER_INFRA_RETRY_DELAY_S-> delay before the re-queued tester job.
+ORCH_TEST_RUNNER_ENABLED=true
+ORCH_TEST_RUNNER_REPOS=
+ORCH_TEST_RUNNER_TARGET=tests/
+ORCH_TEST_RUNNER_TIMEOUT_S=900
+ORCH_TEST_RUNNER_SMOKE_ENABLED=true
+ORCH_TEST_RUNNER_INFRA_MAX_RETRIES=2
+ORCH_TEST_RUNNER_INFRA_RETRY_DELAY_S=30
+
 # ORCH-057 (follow-up ORCH-040): legacy root-owned ownership detect + actionable
 # worktree error. After the uid migration (user: "1000:1000") legacy root:root files
 # in /repos broke worktree creation under uid 1000 with a raw "Permission denied".