NC: held-out eval split — gate auto-apply, keep the judge outside the loop

[mercurialsolo]

Problem

evals.rs currently ships only builtin_scenarios() — a held-in set. Weng's post insists self-improvement be validated against both held-in ("did we fix the weakness?") and held-out ("did we break something else?") splits, with the evaluator sitting outside the loop that evolves the harness.

Today, brain corrections already feed few-shots that bias future brain decisions — actor and judge share a signal path. A held-out eval the loop is never allowed to see or tune against is what keeps that honest.

Proposal

• Add a held-out eval split that is versioned separately and never fed into decisions.rs retrieval or prompt distillation.
• Gate any Tier-1 auto-apply of a prompt/rule edit (NC Phase 1: close the cheap loop — Tier 0/1 verifier-gated auto-apply + rollback #360) on: held-in improvement and no held-out regression.
• Make this a hard dependency of NC Phase 1 (NC Phase 1: close the cheap loop — Tier 0/1 verifier-gated auto-apply + rollback #360), not deferred to Phase 4.

Why it matters

This is the smallest change that makes the entire autonomy ladder safe, and it's independently useful today for regression-testing brain prompt/rule changes. Distinct from the Tier-3 cross-repo transfer test (#137) — this gates the loop's own edits.

Part of epic #358. Blocks #360.