feat: add completion-verification runtime gate (spec 079)

[robertotru]

Problem: Boundline can currently mark a task, stage, or run as complete even when the claimed outcome has no fresh proof from the current working state. This undermines delivery integrity.

Solution: A runtime-owned verification gate that:

• Derives the concrete claim being made at closeout (explicit task metadata, or inferred from context with operator confirmation when ambiguous)
• Selects the narrowest available falsifying proof command for that claim
• Runs it against the current working state
• Captures evidence (command, exit code, summary, fingerprint)
• Refuses closeout when proof is missing, stale, or failed

Key Design Decisions

Decision	Rationale
Normalized workspace fingerprint for staleness	Any tracked or non-ignored untracked file change invalidates a prior proof
Four initial claim kinds	tests_pass, bug_fixed, build_clean, migration_valid — deterministic proof per claim
Claim inference with operator confirmation guard	Low-confidence or ambiguous inference prompts the operator before proving
Stage/run aggregation over child tasks	Child proof remains authoritative; parent claims add to, not replace, child verification
No new CLI command	status, inspect, and orchestrate surface the new projections additively
Canon boundary preserved	Boundline owns proof execution and evidence; Canon owns packet semantics and readiness

User Stories

1. Block Unsafe Completion (P1) — Task stays open when proof is missing/stale/failed
2. Prove the Claimed Outcome (P1) — Runtime runs the selected proving command, captures evidence
3. Surface Verification State (P2) — status/inspect show completion_verification_state, findings, blocked claims
4. Preserve Canon Boundary (P3) — Emit claim → proof → evidence_ref without taking over Canon packet semantics

[sonarqubecloud]

Quality Gate failed

Failed conditions
9.2% Duplication on New Code (required ≤ 3%)

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

❌ Patch coverage is 81.06817% with 436 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
src/orchestrator/session_runtime_finalization.rs	35.06%	187 Missing ⚠️
src/domain/completion_verification.rs	87.44%	86 Missing ⚠️
...c/orchestrator/session_runtime_native_execution.rs	88.60%	77 Missing ⚠️
src/domain/session.rs	50.70%	35 Missing ⚠️
src/cli/output_run_trace.rs	53.65%	19 Missing ⚠️
src/cli/inspect.rs	92.85%	11 Missing ⚠️
src/cli/workflow.rs	33.33%	8 Missing ⚠️
src/orchestrator/session_runtime_surface.rs	0.00%	7 Missing ⚠️
src/cli/session.rs	93.10%	4 Missing ⚠️
src/cli/output_orchestrate.rs	97.50%	1 Missing ⚠️
... and 1 more

📢 Thoughts on this report? Let us know!