feat(runtime): enforce capture admission and evidence proof

[Brad-Edwards]

Plain-Language Summary

• Context: Runtime admission must prove that a backend can capture every required datum before any effectful execution starts.
• Problem: Coarse capability claims and adapter-authored evidence references could admit runs whose required evidence was unavailable or incomplete.
• Fix: This change adds exact capture offers, fail-closed admission, emitted-content proof, and planner authorization across effect-capable phases.

Summary

Require backends to prove exact capture capabilities before execution and bind post-run evidence claims to validated emitted content, while extending planner authorization to every effect-capable runtime phase.

Requirement UIDs

• (none — bug/refactor/maintenance run; see Traceability section below)

Issue Tracking

Closes #1112

ADR Impact

• ADR-021
• ADR-064
• ADR-066

Changes

• Publish atomic field- and artifact-level observation capture offer contracts with fail-closed migration guidance.
• Evaluate SDL, task, and capture-spec demands before planner or trial side effects with deterministic diagnostics.
• Validate emitted evidence bytes, checksums, governed content profiles, and satisfaction bindings after execution.
• Require exact planner-produced authorization for provisioning, orchestration, and evaluation plans, backed by regression and conformance coverage.
• Resolve all SonarCloud findings through structural refactoring without changing fail-closed behavior.

Verification

Passed the full completion graph with 7,714 unit tests, 64 integration tests, contract validation, static checks, formal proof replay, and documentation checks. Repository policy passed, and SonarCloud reports zero open findings and zero security hotspots.

Test Plan

• Unit tests pass
• Integration tests pass if applicable
• Configured completion command passes
• No coverage regression

Combined line coverage is 88%. Focused review-fix suites and affected runtime, compiler, conformance, evidence, manifest, and control-plane suites also passed.

Ground Control Checks

• Configured repository policy command passes
• Pre-push code review and test-quality review completed; all findings fixed or dispositioned

Traceability

• IMPLEMENTS: runtime: reject backends whose capture manifests do not satisfy scenario requirements #1112 ← implementations/python/packages/raes_processor/capture_admission.py, runtime: reject backends whose capture manifests do not satisfy scenario requirements #1112 ← implementations/python/packages/raes_contracts/evidence_satisfaction.py, runtime: reject backends whose capture manifests do not satisfy scenario requirements #1112 ← implementations/python/packages/raes_runtime/control_plane.py
• TESTS: runtime: reject backends whose capture manifests do not satisfy scenario requirements #1112 ← implementations/python/tests/test_issue_1112_capture_admission.py, runtime: reject backends whose capture manifests do not satisfy scenario requirements #1112 ← trial compiler, realization, runtime control-plane, manifest, and backend conformance suites

Checklist

• Code follows the project's coding standards
• Changelog: owned by Release Please (generated from the Conventional Commit PR title; no per-PR fragment)
• Architectural docs updated if stack, package structure, or key behaviors changed

Documentation

Updated: see diff.