fix: bind task evidence and recover interrupted OCI operations

[davidahmann]

Outcome

Expert tasks could omit declared outcome acceptance, and passing commands could
certify human or external scenarios. Interrupted Docker operations lost resource
ownership, while release reconstruction could accept contradictory evidence.
This change enforces the missing bindings and prepares the 0.7.1 maintenance
release.

Changes

• Share outcome scope checks across compilation, direct admission, founder
  execution and closure. Admit first packets for approved outcomes, require valid
  successor packets, and allow preservation-only work.
• Require exact active attestations for human and external scenario evidence.
• Journal OCI ownership before launch. Recover only matching resources, bind
  removal to the observed container and daemon, and preserve uncertain state.
  Qualification scripts retain failed fixtures instead of deleting recovery records.
• Bind retained release evidence to source, qualification, artifact and registry
  identities. Retry registry reads after publication and retain final npm and
  GitHub Latest observations.
• Update operator documentation, package version and the source release record
  before tagging. Preserve the original historical live-worker qualification.

Acceptance and scenarios

Approved scope: product/admission-evidence-hardening.md, AH-01 through AH-08.
Negative cases include exact-digest task undercoverage, incorrect oracle owner,
missing/wrong next tasks, foreign container ownership, changed Docker daemon,
interrupted removal, contradictory qualification and missing release channels.
Five new admission regressions fail on the previous source and pass here.

Validation

• Full native gate: 431 tests, coverage thresholds and installed-package lifecycle.
• Exact-commit structural audit: all nine categories passed.
• Independent review: no material findings at 4f20caf47873bf9765302fc9fd03f2c32b681847.
• Full packed-artifact canary: install, greenfield, adoption, downstream operation,
  recovery and security passed.
• Real pnpm OCI canary: service/CLI/report and failure, timeout, cancellation checks passed.
• Real Docker probes: both resource roles recover after controller/client death;
  foreign ownership remains untouched. No probe containers remain.
• Hardened reconstruction succeeds against retained 0.7.0 release assets.
• Initial Linux CI exposed an insufficient aggregate timeout for the expanded
  reconstruction matrix. Its budget is now 60 seconds; every assertion and the
  per-process 10-second bound remain unchanged.

Risk, authority, and residual limitations

The owner authorized this maintainer repair, merge and fresh latest release.
Publication still requires the protected exact-tag candidate/publish workflow.
Deadlines require a live controller; this is not a daemon-independent watchdog.
Never-observed ambiguous Docker launches remain blocked. The retained live-agent
qualification describes September 5 and its original tool versions; fresh
package tests do not renew that observation. Downstream customer gates remain
separate from these software checks.

Assistance disclosure

• Agent-assisted implementation and independent review.
• Commits include DCO sign-off.
• No credentials, private customer inputs or raw execution logs are included.