feat(audit): record explicit operator acceptance

[shaug]

TL;DR

Adds live, fail-closed delivery audit and exact operator acceptance for Atelier assignments.

Summary

• Reconstructs delivered work from the canonical Git mailbox and fresh GitHub state, classifying every required evidence predicate as satisfied, violated, unknown, or stale.
• Binds pull request head and base, required-check provider identity, validation, structured independent review, comments, reviews, threads, and explicit finding dispositions to the exact delivered candidate.
• Records acceptance only after explicit operator confirmation and a strictly newer unchanged provider observation, preserving the exact receipt, candidate, evidence, and historical acceptance while later drift remains visible.
• Rejects draft, review-blocked, policy-blocked, stale, incomplete, ambiguous, or wrong-provider evidence without merging, deploying, or mutating native tickets.

Tickets

Fixes #780