feat(telemetry): add Phase 9 operational execution reporting

[HelloThisWorld]

Summary

Implements SpecBridge vNext.10.2 Phase 9 telemetry, token-conservation analytics, and operational reporting.

• derives a versioned execution report exclusively from durable job facts
• reports secondary routing, strong-model fallback, research avoidance, cooldown, attempts, verification, closure, intervention, reliability, efficiency, and token coverage
• adds the report job CLI command with JSON, verbose, and no-persist modes
• adds the read-only job_report MCP tool
• adds deterministic comparison, replay deduplication, legacy compatibility, bounded diagnostics, documentation, and regenerated plugin bundles

Validation

• TypeScript typecheck and ESLint passed
• Phase 9 targeted tests: 18/18 passed
• full Vitest run: 2832 tests passed; 26 Windows sandbox EPERM failures were isolated to 13 files, and all 118 tests in those files passed outside the restricted sandbox
• public contract snapshots and MCP documentation checks passed
• security scan passed
• Claude and Codex plugin validators passed
• isolated Claude and Codex plugin verification: 15/15 checks each

Security

Reports are derived from persisted authoritative facts. Human-readable values and diagnostics are redacted and bounded. Raw prompts, model output, secret-bearing failure text, and environment values are not emitted. The MCP reporting surface is read-only and does not persist report state.

Checklist

• lint, typecheck, and tests pass locally
• public contract changes are intentional and snapshots are updated
• documentation is updated for user-visible behavior
• CHANGELOG entry added
• code, comments, docs, and commit messages are in English
• fixtures are synthetic and contain no employer or client proprietary content
• no credentials, tokens, or secret values are present in the diff or test output