feat(evidence): add v3 qualification and immutable recovery

[abrichr]

What this changes

This PR adds the private v3 workflow qualification producer, fixes two immutable release recovery gaps, and updates the public evidence layer to the final contracts at OpenAdaptAI/.github@989681f6f475616b7e2cb72360c716db0927f7ad:

• qualification release v2
• qualification admission v4
• qualification evidence decision receipt v2
• production acceptance manifest and summary v3
• Flow release verification receipt v1

The private producer covers healthy, safe halt, idempotency replay, uncertain delivery, declared attended, and governed repair for every task. It requires at least three signed trials in each task and condition cell. It derives silent incorrect success, over-halt, dispatch, retry, replay, effect, cleanup, intervention, and repair counts from signed receipt facts.

Every uncertain-delivery trial must return RECONCILIATION_REQUIRED. The producer requires one dispatch for that trial and rejects blind retry or replay dispatch. Each receipt also binds its source artifact, campaign, run, protected repository, workflow, ref, commit, environment, and runner identity.

The public summary command uses the current wall clock and a clean checkout of the pinned central commit. An accepted summary requires an active signer registry, authority state, and revocation state, plus registered objects that pass the central verifier. This pin's signer registry pointer is inactive, so the command refuses to write accepted evidence.

The pair command validates the regular object against its exact central JSON Schema before it writes a file. Kinds without a final central schema are refused.

The PyPI recovery check reads an existing version before skip-existing can continue a partial upload. GitHub Release publication uses a repository-scoped openadapt-release token.

This PR installs .github/workflows/issue-production-acceptance.yml at the path the central schemas name as the only issuer. Every run refuses. It does not write a manifest, a summary, an attestation, or a GitHub Release.

Authority and privacy boundary

Evals does not own signing keys, the signer registry, the revocation ledger, or KMS policy. The command imports the verifier from the exact pinned central checkout and refuses a dirty checkout.

Private campaign rows, source artifacts, task names, application values, environment values, and live identities stay behind the private evidence boundary.

Fail-closed dependencies (not waits)

Central main at 989681f6f475616b7e2cb72360c716db0927f7ad contains the final schemas and verifier code. Its signer registry pointer is inactive. The summary and pair commands refuse to write accepted evidence at this pin. That is the correct production behavior.

Checked against live state:

• signer registry, authority state, revocation state: still inactive on OpenAdaptAI/.github main. The producer refuses. No mock accepted evidence.
• production acceptance issuer: installed in this PR and refuses issuance.
• protected trial receipt vectors / source manifest v2 / source seal v2: not present in the public central pin. The public path cannot accept evidence without them because the registry is inactive.
• protected release environments and App credentials: release-identity and pypi exist; OPENADAPT_RELEASE_APP_ID=4730708; OPENADAPT_RELEASE_APP_PRIVATE_KEY is set in both environments.
• hosted test must pass at the exact head after the issuer commit.

This PR does not issue an admission, activate an issuer, sign evidence, publish a package, create a release, change a repository setting, or copy private evidence into a public repository.