feat: add decentralized strategy convergence

[douglas-grishen]

What

• add the public @agentplat/collective-runtime/strategy-convergence entry point
• add canonical contracts for scopes, certificate observations, policies, cycles, scores, recommendations, decisions, bounded state, and handoff
• implement a deterministic local convergence reducer with minimum cycle intervals, sustained-cycle hysteresis, improvement margins, cooldown, and oscillation guards
• suppress recommendations during partitions, unresolved divergence, unsafe/insufficient evidence, and incomplete recovery windows
• preserve a credible current strategy inside a policy-defined diversity margin
• compare strategies only within one newest membership/configuration and evidence-policy view
• intersect source coverage across contributing certificates to prevent rotation or replay amplification
• add CAS runtime, retry behavior, idempotent replay, logical-time high-water marks, and predecessor-bound handoff
• adapt evidence certificates into convergence cycles and stable recommendations into doubly bounded local adaptation priors
• publish documentation, ADR, threat model, public type contracts, packed consumer, and focused tests

Why

Evidence exchange supplies trustworthy aggregate outcomes, but reacting immediately to the current leader would create churn, herd behavior, and partition-sensitive decisions. This controller requires sustained compatible evidence before it recommends a locally eligible strategy, while preserving local autonomy and useful diversity without a central optimizer.

Safety properties

• remote evidence cannot add a locally ineligible strategy
• recommendations are advisory and never execute strategies or grant authority
• membership/configuration and evidence-policy forks fail closed
• duplicate and rotating source sets cannot amplify independence
• partitioned, oscillating, divergent, unsafe, and insufficient views emit no positive prior
• every prior is short-lived, confidence-scaled, and capped again by Local Strategy Adaptation
• all retained state and retries are policy bounded

Validation

• full workspace build passed
• full workspace type-check passed across 48 packages and public contracts
• public audit: 2,523 files, 0 secret/restricted matches
• unit suite: 876 tests, 869 passed, 0 failed, 1 skipped, 6 todo
• focused convergence suite: 16 passed, 0 failed
• packed-consumer verification: 48 tarballs and 96 public API surfaces
• clean pnpm and independent npm consumer installs passed

Review note

This PR is intentionally stacked on #98 so the evidence-to-convergence integration can be reviewed incrementally.