feat: redesign evaluator core in Python

[jon-devlapaz]

Summary

• replace the broad Go/multi-harness evaluator with a focused packaged Python 3 Codex evaluation loop
• retain exact skill hashing, isolated control/treatment runs, run-local Codex homes, structured rubric grading, blinded pairwise comparison, quality-aware reports, and human-labeled calibration evidence
• add Task 8 calibration binding: production calibration exercises both candidate orientations, rubric runs bind an accepted calibration fixture hash, missing calibration cannot complete quality evidence, and malformed or drifted bindings are runner-invalid
• update the public skill instructions, minimum executable contract, Phase 2 plan, and checklist to match the implementation

This PR covers the full original 20-commit python-core-redesign stack from origin/main, not only Task 8, plus one CI-only commit correcting the immutable actions/setup-python v6.0.0 pin.

Validation

• PYTHONDONTWRITEBYTECODE=1 python3 -m unittest discover -s tests -v — 29 tests passed
• tracked Python py_compile with bytecode redirected outside the repository — passed
• git diff --check HEAD~2 HEAD — passed for the final Task 8 commits
• skills/skill-eval-loop/scripts/healthcheck.sh — valid: true
• pre-push ancestry check after fetching origin/main — 0 behind / 20 ahead before the CI-only follow-up; dry merge completed without conflict diagnostics
• GitHub Actions on the final head — 12/12 checks passed across push and PR runs, including validate, four-platform standalone package verification, and Tink package verification

Evidence boundaries

• OpenAI judging remains provisional_non_independent; this PR does not claim independent evaluation.
• The recorded toy pilot was saturated and produced a pairwise tie. This PR makes no skill-quality winner claim.
• Task 7 live verification on a named, locked, non-toy suite is deferred.
• Tasks 9 and 10 are not started: there is not yet an honest CI quality gate or an independent judge/holdout.
• Calibration binding uses the operator-controlled calibration.json plus its original absolute fixture path as the trust root. The runner verifies internal consistency and hashes but does not authenticate the origin of raw prompt, response, trace, or stderr artifacts.