settle: validate settled_at's format, and name dispositions on every clean path that used one

[evanharmon1]

Two record-quality items on settle, both raised by the current-head Codex
review of #424 after that PR reached its 4-round shepherd cap. Neither is a
safety hole — no wrong verdict follows from either — which is why they were
adjudicated P2 and filed rather than fixed there.

1. settled_at is validated only as a string

Invariant

Every field of a settlement record either satisfies the constraints settle
writes it under, or the state is refused as malformed. settle writes
settled_at as an ISO-8601 UTC second.

Current violation (observed 2026-08-11)

read_state checks .settled_at | type == "string", so a corrupted or
hand-reconstructed entry carrying "" or not-a-time is honoured: it can
suppress a matching finding and reach clean while holding an invalid durable
record. Every other field of the entry is now constrained (surface, id,
disposition, nonempty note, nonempty fingerprint); this one was left as a bare
type check.

Verify

rg -n 'settled_at \| type == "string"' \
  ai/skills/universal/shepherd/assets/check-codex-cloud-review.sh

A hit means the format is still unchecked. Fix: apply the same timestamp
constraint --now uses, and add a fixture with a malformed settled_at.

2. Dispositions are named only on the disposition-specific clean path

Invariant

Any terminal-clean result that relied on a recorded disposition says so in its
detail — the caller cannot otherwise tell that a human's adjudication, rather
than a verdict Codex wrote, is what made the head clean.

Current violation (observed 2026-08-11)

Where a head carries both inline findings answered in-thread AND a settled
non-thread finding, adjudicated_findings is set, so the inline
adjudicated-clean branch exits before the disposition branch and the detail
reports only trusted replies. The same happens when a clean verdict wins
above. The disposition still did work that nothing in the result mentions.

Verify

rg -n -B4 'all adjudicated by trusted in-thread replies' \
  ai/skills/universal/shepherd/assets/check-codex-cloud-review.sh

If that branch cannot mention applied dispositions, this is open. Fix: thread
applied_dispositions into every terminal-clean path that suppressed a
settled target, and cover the mixed case with a fixture.

Acceptance criteria

• settled_at is validated for ISO-8601 UTC format, with a malformed-value fixture proving the refusal.
• Every terminal-clean path that suppressed a settled target names the applied dispositions, with a mixed inline-plus-settled fixture proving it.