feat: consume head-bound runtime verification receipts

[Wibias]

Summary

Adds the first GitHub Delivery consumer layer for project runtime-verification evidence.

• adds a deterministic runtime receipt classifier with pass_current, stale, fail, blocked, and invalid-input semantics
• requires exact repository identity and full 40-character HEAD binding
• rejects malformed positive receipts, failed cleanup, and non-passing checks
• adds focused unit coverage for current, stale, fail, blocked, repository mismatch, malformed SHA, and producer-contract surface validation
• adds GD-RUNTIME-001 as a conditional policy module
• activates the module only for create-pr-for-issue when a project verifier exists and the candidate changes observable runtime behavior or has material runtime risk
• keeps tests, CI, proactive contract verification, and runtime evidence as separate evidence classes
• does not generate or repair project verifiers inside GitHub Delivery

Rollout boundary

This PR does not change the global authoritative ship-gate.mjs. It establishes a deterministic consumer and conditional workflow policy first, so false blocks and stale-evidence behavior can be validated before any later global hard-gate integration.

Verification

Verified on final head 940929a3d81bc8752518f088f2de832de86b90a6.

• CI: success, including Node 22, canonical Node 24 repository checks, and Node 26 compatibility
• CodeQL: success
• Dependency Review: success
• create-PR workflow remains below the existing <9300 compactness budget without weakening that gate
• existing broker-mutation safety contract is preserved, including push_code, create_pr, update_pr_body, and assign_issue
• runtime receipt consumer matches the merged .agents surface contract and fails closed on missing/invalid surface

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Team

Run ID: c019aa3a-1e65-4d36-b260-4a2194bf9714

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}