chore: review and refresh QCoder upstream pins

[echoomegaprime]

Summary

• refresh all 12 reviewed upstream provenance pins after exact GitHub compare review
• record commit counts, changed-file scope, license-byte verification, risk, and execution posture
• correct autonomy evidence to identify the canonical echoomegaprime/echo-qcoder repository
• add a regression test preventing legacy repository identity from returning

Why

The scheduled autonomy tick correctly failed closed when its upstream pins drifted. Each target was reviewed before updating; runtime dependencies remain exact and reference-only or sidecar projects remain non-executing unless separately authorized.

Validation

• node --test scripts/tests/*.test.mjs — 18/18 passed
• npm run verify — typecheck, lint, format, 41 application tests, 60/60 evaluator cases, powerpack/catalog validation, and production builds passed
• node scripts/validate-powerpack.mjs --online — 21 repositories valid with zero drift
• node scripts/autonomy-tick.mjs --output .runtime/autonomy/verification-20260815-post-rebase.json — all gates green
• production dependency audits — zero high-or-greater vulnerabilities

Security

• exact target license bytes match the recorded MIT or Apache-2.0 licenses
• no runtime package range was widened
• no reference-only project was promoted into executable scope
• high-transitive-audit Promptfoo installation remains withheld
• no credentials or private infrastructure are included in public evidence

Evidence

• reviewed commit: 353d4331711464b87d0d7d66ac8e73799c0a0ee1
• detailed review: docs/UPSTREAM_REVIEW_20260815.md
• hosted GitHub Actions remains an external account-level gate until GitHub clears the current user restriction; this draft is not merge-ready until canonical hosted CI is green