Add fresh verification completion guard

[lxingy3]

Summary

Adds an opt-in VerificationGuard capability for coding agents.

• successful source edits advance a per-run generation and make older verification evidence stale
• common test, lint, type-check, and build commands record pass/fail evidence for the current generation
• an attempted completion without a fresh pass gets a bounded verification nudge through ctx.enqueue
• Markdown, MDX, and reStructuredText-only edits are exempt by default
• custom mutation, verification, and shell tool names are configurable

The implementation uses the existing capability hooks only. It does not change agent-loop or tool-execution semantics.

Linked Issue

Fixes #320

Validation

• ruff format --check and ruff check
• strict pyright on the new package and tests
• 20 focused behavior tests with 100% branch coverage for the new capability
• 47 documentation and example-parity tests
• full suite on Windows: 1,760 passed and 12 skipped; the remaining failures are in POSIX path, symlink, permission, process-group, and Proactor subprocess cases exercised by the existing filesystem, ACP, media, overflow, and shell tests

Checklist

• Linked issue exists and is referenced above
• Tests added/updated for new behavior
• make lint && make typecheck && make test passes locally (focused checks pass; full Windows limitations are listed above)
• No changes to pyproject.toml or uv.lock (dependency changes require a separate issue)
• Docstrings use single backticks (not RST double backticks)