refactor(ah-ickz): share verifier-only queue policy

[rmstdope]

Summary

Centralize the verifier-only candidate label and jq filter across producer, bugfixer, and UX queue readers, without an extra process on fleet ticks. Add a cross-queue test that substitutes a fixture-only label in a throwaway consumer.

Bead: ah-ickz

Validation

• bash tests/candidate-label-policy.sh
• bash tests/assignable-beads.sh
• bash tests/bugfix-candidates.sh
• bash tests/stage-candidates.sh
• bash tests/gate (passed)

[rmstdope]

Review (cold read, reviewed_head: 3d15ecd459424c369b320196c6c740419664036a) — reviewed before merge against bead ah-ickz and the Cerebro reviewer checklist.

1. P2 — Regression-test gap: tests/candidate-label-policy.sh. The test recorded each bd invocation but did not assert that the producer and bugfixer passed the fixture verifier-only label to bd --exclude-label. Its output assertions could still pass if a query-time exclusion reverted to a hard-coded label, because the stub returned all candidates and jq filtered them afterward.

   Resolution: Added explicit bd --exclude-label fixture-verifier-only assertions for the producer and bugfixer invocations. The UX queue goes through work-beads, which has no equivalent label-exclusion option; its sentinel-label output assertion verifies the shared jq policy. The focused policy suite passes at commit 80c52d7.