feat: add revision-bound signal decisions

[roodboi]

Summary

Implements the approved HACK-1033 capability evolution.

• adds a closed fclt ai loop decide and activity_decide JSON/MCP lifecycle for accept, redirect, reject, and defer
• atomically records revision-bound, portable machine-local receipts under the existing evolution-loop lock
• revalidates locator, scope/root/runtime identity, issued activity, queue revision, approval source, and lifecycle history; rejects stale, replayed, moved-root, cross-scope, duplicate, malformed, unsafe, and non-signal inputs
• preserves bounded target, evidence, linked-work, expected-outcome, verification, and next-action context for external work-unit construction without mutating capability, Git, trackers, proposals, tasks, or external systems
• adds exact fixtures for the four already-landed approved signal families, the explicit hold, and six stale Git cursors while preserving coverage/freshness separation
• updates CLI/plugin references, capability declarations/matrix, operating-model guidance, and generated built-ins

Linear: https://linear.app/hackdance/issue/HACK-1033

Verification

Passed:

• bun run check
• bun run type-check
• focused activity decision, reconciliation, MCP/plugin, protocol, CLI paths, built-in, remote, path, and doctor suites
• bun run build
• bun run build:verify
• bun run pack:dry-run
• compiled binary help smoke for ai loop decide
• git diff --check and changed-line privacy scan
• isolated project enrollment timeout rerun: 1/1 passed
• isolated read-only audit timeout rerun: 1/1 passed

Bounded full-suite evidence:

• first run completed in 423.52s: 1,000 passed, 18 failed; failures were one concurrent enrollment timeout plus audit-fix baseline failures
• second run completed in 257.71s: 994 passed, 2 audit-only 5s timeouts
• pre-commit rerun completed in 222.18s: 1,001 passed, 17 audit-fix baseline failures
• a representative audit-fix failure reproduces with the same error on an untouched origin/main archive: Selected finding has no exact report-authorized remediation binding
• this PR changes no audit implementation or audit fixture files

Behavior and boundaries

The receipt is append-only lifecycle evidence. It does not implement the decision, grant authority, apply a proposal, mutate canonical capability, call Git/Linear/external systems, or spawn work. A later receipt requires a genuinely newer signal queue revision. A hold/defer remains visible and unimplemented.

Coverage completeness and cursor freshness remain independent in JSON, activity output, persisted reconciliation reports, fixtures, and aggregate behavior.

Rollback

Revert commit cdd978a. Existing machine-local decision receipts are retained as history; no canonical or external data migration is introduced.

Release note

Adds revision-bound signal-family decision receipts and explicit coverage-versus-freshness reconciliation behavior. Semantic release will derive the feature release from the Conventional Commit after merge; this PR does not release or deploy.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[linear-code]

HACK-1033

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: cdd978a658

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Mark signal decisions as approval-required

When the locator is for a signal item, activityActionClass() returns handoff, so this new signal-specific resolve plan still serializes mutation.approvalRequired: false even though decideActivityAction() rejects every decision without approve=true. Consumers that use the resolve JSON to decide whether to show or require approval will suppress the required approval prompt or misstate the safety boundary for signal decisions; set the approval flag true for signal resources.

AGENTS.md reference: AGENTS.md:L130-L130

Useful? React with 👍 / 👎.