Extract a harness-neutral constrained-generation contract

[levineam]

Goal

Extract the safeguards currently embedded in one harness path into a jarvOS-owned constrained-generation contract without changing live behavior.

Contract

Represent runtime proof, tool denial, effective-model/fallback detection, usage evidence, and delivery denial in a harness-neutral interface. Refit the existing verified implementation for fixture parity; mark all unproven backends claimed-unverified.

Done criteria

• Recorded-fixture golden parity before/after extraction.
• Existing runtime path remains default; no activation or traffic cutover.
• No harness is falsely marked verified.
• Focused/full tests and independent branch review pass.

Depends on #258 and #259. Coordination: levineam/clawd#1249.

[levineam]

Independent Luna/max review of draft PR #270: HOLD. P1: runtimeProof.status: unproven currently yields ok:true/runtimeProofPresent:true; reject it fail-closed. P2: the new fixture and golden are both hand-authored in this commit, so they prove self-consistency, not parity with an existing verified path. Either trace the fixture to an independently preserved prior behavior/evidence source or narrow the claim from golden parity to contract fixtures. Runtime remains inert and admitted:false; no provider/harness was invoked.

[levineam]

Rereview of 32ca74a: runtime-proof P1 is fixed, but the public repo contains no preserved verified implementation/receipt that can support the original refit/golden-parity criterion. Decision: keep #261 open for the later adapter refit; PR #270 may land only as the honest contract-fixture foundation and must not claim to close #261. Remaining P2: caller-supplied verified fields are echoed and could be mistaken for jarvOS verification. Reject or clearly rename those claims so no untrusted caller can manufacture verified-looking output.