feat: scoped evidence-backed completion auditor

[aditya0si]

Summary

Add manual OpenCode-first completion auditing: trusted configured task/criteria, pinned delta snapshots, deterministic scoped verdicts, redacted hash-chained evidence storage and replayable reports. Add bounded planning, a separate default-disabled approval-bound Docker fixture runner, and regression catalogue.

Verified locally in implementation worktree

• Full verify exited 0.
• Regression catalogue 30/30 matches, two reproducible runs; not independently labeled semantic ground truth.
• Real Docker integration 38/38 passed.
• Real OpenCode 1.18.13 with opencode-go/deepseek-v4.1-flash exercised plan/check/report with matching stored identities.
• npm pack dry-run passed.
• Final read-only independent review found no remaining concrete blocker in secret predicates, cleanup classification, prewrite overlap or catalogue claims.
• Gitleaks source scan found only two deliberate synthetic redaction-test canaries; explicitly allowlisted locally. No real secret finding.

Limitations / follow-up

Static configured byte predicates only: not semantic correctness, suite completeness, authenticated evidence, malicious-code containment, hostile filesystem races or power-loss durability. Unsafe planner suggestions are dropped with explicit refusal counts; they never replace bound acceptance criteria. Regression runner is source-only. A fresh exported-tree Windows verification attempt timed out with git-init fixture failures; do not treat that attempt as passed. CI is the cross-platform gate.

No npm release, original-checkout merge, local logs, generated audit records, research notes or private plans included. Docker adversarial fixture sources are included for reproducibility. Existing version retained; release/versioning deferred.