feat(codex-local): execute scheduled assertions

[goldmedal]

Summary

• add a generic assertive / tool / scheduled / assertion execution contract to codex:local
• validate compiler-resolved pinned bindings and trusted successful read-only Wren evidence
• keep freshness deterministic in the host: fresh skips Codex, stale runs one ephemeral no-MCP severity turn
• report scheduler and notification as borrowed caller capabilities, with no Warble-owned automation state
• add CLI, manifest/describe, lifecycle, isolation, conformance, and adversarial coverage

Why

TASK-467 closes the target-parity gap for externally scheduled Warble profiles such as genbi-monitor while preserving Warble as a stateless one-run CLI. Dispatch remains profile-agnostic and is selected from the complete IR shape and exact capability closure.

Impact

Callers can invoke one manual or externally scheduled assertion occurrence with typed Wren evidence. The host validates the effective model/cadence bindings, determines fresh versus stale, emits the verified verdict/signal, and never installs or owns a scheduler, registry, run-history store, notification destination, or reusable Codex thread.

Validation

• just lint
• just test
• just build
• just release
• just doc
• just publish-check
• just install-ts
• just lint-ts
• just test-ts — 240/240
• just build-ts
• just install-codex-ts
• just lint-codex-ts
• just test-codex-ts — 170/170
• just build-codex-ts
• docs reference drift, git diff --check, and public-boundary scan
• independent review and remediation re-review: accepted