fix(P0): fail-closed evidence and honest Temporal-to-Mongo reconciliation

[Rafa-Innerchispa]

P0 safety correction: evidence and workflow truth for ALL agents

Audit on 12 Oct 2026, after new Cursor commits 0e5acb97, 911f9379, a7553157 and 435863a9 in main.

Two independently verified defects

1. execution_receipts.completion_evidence_from_worktree defaulted test_exit_code=0 even if no tests ran. New behavior: absent test result stays absent; only explicit real exit code is recorded; failed tests fail the receipt. This applies to Cursor/Codex/Antigravity and internal runners.
2. reconcile_ops_mongo_temporal.py treated Temporal RPC COMPLETED as business task completed, but Temporal workflows return {"status":"failed"} even when the RPC completes. Now read the returned workflow result, require the completion gate for coding before marking completed, do not mutate tasks on Temporal transport failure, and use a compare-and-set projection to avoid overwriting new claims.

Tests and impact

• Added regression tests for missing/failed test evidence, Temporal RPC success with task failure, missing result, blocked outcome, unavailable Temporal, coding gate, read-only success.
• Added reconciler and test paths to CI triggers, compile and pytest.
• No production deployment, no network/system changes, no main edits, no task requeue.
• Distinguish observed Mongo labels from independent Temporal/host proof. Even ops_f46a62594c73 currently says completed while preserving a historical verification_error; do not wipe it or mark every provider certified.
• ops_1369791f60a0 (AMD) and ops_cb8cafe5c2f4 (Intel) are read-only Cursor interactive canaries. They do not demonstrate unattended Composer editing for all providers.
• ops_ba6e885a1cf3 is a local product-write canary with a real objective path but no commit SHA in agent_result; release still needs commit/test/provenance.
• Critical safety principle: neither model-generated prose nor Temporal RPC success nor a guessed test result authorizes terminal COMPLETED.

Merge only after CI PASS and code review. Then ensure runtime imported SHA matches main on AMD/Intel and new terminal canaries; do not start duplicate worktrees or deploy simultaneously with Cursor.