Enforce orchestration evidence and add evaluation benchmarks

[whchi]

What changed

• enforce delegation-scoped evidence, observed file-change tracking, configurable envelope enforcement, and operator-declared verifier commands
• add routing-contract, checker-recall, mutation-fixture, and statistical benchmark evaluation surfaces
• replace the simple four-domain prompts with one canonical delegation-required task catalog and hard-fail zero-child extraction
• document the runtime decisions in ADR 0005 and the evaluation protocol in ADR 0006

Why

The existing runtime could trust maker self-reporting, lose evidence attribution across child sessions, and discover malformed envelopes only after execution. The benchmark pipeline also used single runs and default-pass labels that could overstate quality.

Impact

Runtime verification and trace diagnostics become stricter and more observable. Benchmark results require explicit acceptance data, report cost/time before token detail, and can evaluate routing and checker quality independently.

Validation

• bun test — 193 passed, 0 failed
• bun run build — passed
• git diff --check — passed