Add evidence-gated cost recommendations

[ictechgy]

Summary

• add strict task-free cost-profile and qualification-card contracts
• add offline review-cost-profile and non-executing recommend commands
• bind route, cost, and aggregate evidence fingerprints with conservative abstention gates
• preserve provider-specific model, effort, and task-delivery boundaries without changing built-ins or execution behavior
• extend docs and macOS/release boundary coverage

Verification

• Python 3.10.20: 808 unittest tests passed with ResourceWarning promoted to error
• Python 3.14.6: 808 unittest tests passed with ResourceWarning promoted to error
• Ruff 0.16.2 check and format passed
• strict mypy passed across src and tests
• compileall and git diff check passed
• offline wheel and sdist build plus strict Twine check passed
• extracted sdist: 802 tests passed, 13 platform skips
• clean wheel route to review-cost-profile to recommend smoke passed without a vendor executable on PATH

Security and privacy

• both evidence files are validated before task stdin is read
• task text and task hashes are excluded from receipts and diagnostics
• user/evaluator cost and quality assertions remain explicitly unverified
• recommend never starts a vendor, retries, falls back, changes built-ins, or authorizes run