feat(qualification): add Phase 10 production release gates

[HelloThisWorld]

Summary

Implements SpecBridge vNext.10.2 Phase 10 as a release-qualification and freeze layer rather than another runtime feature phase.

This adds immutable candidate identity and runtime digests, the mandatory A-T gate matrix, a versioned 14-fault historical replay catalog, deterministic READY/NOT_READY decisions, one-shot qualification artifacts, runtime pinning, telemetry honesty checks, reproducible CLI entry points, CI coverage, and operator documentation. PRODUCTION_READY is emitted only when every mandatory gate passes against the same frozen candidate.

Key changes

• add orchestrate qualify freeze and orchestrate qualify release
• bind evidence, reports, and runtime start/end identity to the frozen candidate
• detect runtime mutation, completed-work redo, candidate loss, and duplicate logical dispatch
• preserve failed evidence and reject missing gates as SKIPPED_NOT_ALLOWED
• rebuild and validate Claude Code and Codex plugin bundles
• publish Phase 10 public contracts, qualification subsets, CI coverage, and production freeze policy

Validation

• build: passed with pnpm 9.15.9
• lint: passed
• typecheck: passed
• security scan: passed, 692 files and no findings
• public contracts: all 16 snapshots match
• Phase 10 fast suite: 22 tests passed
• historical fault replay: 103 tests passed
• full suite: 2,866 passed and 2 skipped; two parallel-load timeouts both passed in isolated reruns, 48 passed and 1 skipped
• Claude plugin validation and all 15 isolated bundle checks: passed
• Codex plugin validation and all 15 isolated bundle checks: passed
• git diff --check: passed

Checklist

• pnpm lint, pnpm typecheck, and pnpm test pass locally; lint/typecheck pass, while the full parallel test invocation had two contention timeouts that pass in isolation
• public contract snapshots were intentionally updated and check:public-contracts passes
• Documentation updated for user-visible behavior
• CHANGELOG entry added
• Everything is in English
• Examples and fixtures are synthetic
• No credentials, tokens, or secret values in the diff or recorded fixtures

Security

This change pins the control-plane runtime identity without granting authority, rejects secret-shaped qualification evidence, preserves the human-only approval firewall, prevents missing evidence from becoming a pass, and keeps PRODUCTION_READY fail-closed. It does not add an approval-shaped MCP surface or permit runtime self-repair.

Release status

The implementation is intentionally NOT_READY until a clean committed candidate completes the real local-model, required DeerFlow, unattended soak, and reproducibility gates. This PR does not create a release tag or claim production readiness.