fix(work): keep narration truthful across steer

[Lucas1479]

中文摘要

给中文审阅者的速览；下方英文正文仍是完整技术说明。

• 问题：中途 amend 后，状态查询可能继续选用修改前的 design，丢失 verified=false，并让 Narrator 把未来计划说成已实现或已验证结果；同时 run intake 会抢占首条语义播报，旧的待播非终态内容也不会随 steer 失效。
• 修复：复用现有 steering revision/observedAt 与 milestone observedAt/verified/source 形成当前证据边界。queued/applied steer 后不再把旧计划当作当前进展；rejected steer 仍保留原事实；过期待播内容被清理，但 terminal truth 不受影响。
• 工具边界：Codex 原生工具的结构化标题只进入“未验证方向”通道；任意 js/dynamic-tool 输出文本仍不能被解析成文件、能力、验证或完成事实。success=false 也不会再因为 status=completed 被升级为成功。
• 实现范围：run.created 只更新 Work 界面，不消耗首条实质语音机会。没有新增 schema、模型调用、兼容 fallback、工具名白名单或输出关键词规则。
• 验证：公开完整 Python 基线 1682 项通过、1 项跳过；定向状态查询、steer、Observer、Codex adapter 与语义投影测试通过；Ruff、compileall、diff 检查及公开 Electron/Python CI 均通过。尚未补做新的真实 Kurisu+TTS 长作业验收。

关联问题：#24。

What and why

Work narration could keep a pre-amend design as the latest status evidence, discard its verification strength, and present future intent to the Narrator as verified progress. The same run could spend its first spoken update repeating the Host-dispatched task, while queued pre-steer narration remained eligible after the instruction changed.

This PR repairs the complete current-evidence boundary:

• run intake remains visible on the Work surface without becoming semantic narration;
• queued/applied steer checkpoints fence status evidence by the existing observed timestamps;
• rejected steer keeps the prior fact current;
• milestone source, verification, and evidence strength reach status and narration;
• queued nonterminal narration from the superseded instruction is retired while terminal truth remains protected;
• Codex native tool fields are normalized at the adapter boundary;
• a structured native tool title becomes only an unverified direction;
• arbitrary dynamic-tool output remains fail-closed;
• explicit success=false cannot be upgraded by status=completed.

Fixes #24

Product semantics

This is a bounded Work presentation and evidence-authority repair.

The Host continues to own Work identity, steering state, activity facts, verification, cadence, and delivery. Provider prose and native tool titles remain reported evidence, never completion or Host verification. Existing durable milestones remain in history; only their use as current status evidence is fenced after steer.

The implementation reuses activity steering revision/observedAt, milestone observedAt/verified/source, and the existing narration supersession path. It does not add a schema, model pass, tool-output parser, compatibility fallback, or js-specific exception.

Change class

• Routine fix, documentation, test, maintenance, or presentation-only UI
• Product-semantic or public-contract change discussed in the linked Issue
• Isolated, default-off experiment

Owning layers: Codex canonical event adapter, Host Work activity/status projection, and Work Observer cadence/delivery.

User-visible effect: after an amendment, Kurisu no longer reports the superseded design as current verified progress; intake does not consume the first substantive spoken update; structured current direction can still be narrated without being upgraded to a result.

Compatibility or migration impact: none. No database, persisted-state, public configuration, Provider capability, protocol, or API migration.

Evidence

Focused public-baseline checks:

• Work narration, semantic progress, Codex adapter, activity snapshot, governor, recovery, quiet narration, and role sanitization: 90 passed.
• Task lookup: 24 passed.
• Runtime control authority: 14 passed.
• Workflow progress direct regression checks passed.

Full public Python baseline:

• python -X utf8 tools/run_tests.py
• 1682 passed, 1 skipped.

Static checks:

• Ruff on all changed Python files passed.
• compileall on all changed Python files passed.
• git diff --check passed.

No Electron files, dependencies, settings, schema, or UI layout changed. No paid live-model or new real TTS journey was used; deterministic event-chain and full-suite evidence cover this PR, while a post-merge live narration journey remains useful acceptance evidence.

• Relevant Python tests pass
• CPU/model-less baseline remains supported
• Electron npm run build passes (not applicable; no Electron change)
• Dependency audit passes (not applicable; no dependency change)
• Before/after screenshots are attached (not applicable; no UI layout change)
• Documentation/examples are updated (not applicable; existing authority contract is restored without changing settings or public schema)

Final check

• This PR addresses one coherent Work narration truth problem
• It reuses existing authority and freshness facts instead of adding parallel state
• Unknown dynamic-tool output remains fail-closed
• It does not add a speculative API, fallback, model pass, or provider-output keyword parser
• No secrets, local state, model weights, voice material, restricted assets, runtime logs, or personal paths are included
• Third-party notices and provenance are preserved

[Lucas1479]

Maintainer self-review complete: no blocking findings. The change removes mechanical run intake from spoken semantic progress, preserves Provider-authored direction and Host-observed facts with explicit evidence strength, and fences pre-steer milestones/directions using the Ledger steering state and observedAt boundary. Queued/applied steer retires stale nonterminal narration; rejected steer deliberately preserves prior evidence; terminal truth is not consumed. Dynamic tool output remains non-authoritative, and explicit success=false cannot be overridden by status=completed. Local validation on the rebased head: Ruff passed and 125 focused narration, observer, activity snapshot, status, adapter, recovery, and language tests passed. Required build and cpu-model-less checks are green on head e8dc5b2. Admin merge bypass is used only for the unavailable external approval requirement.