Make release qualification repository-owned

[vriesd]

Summary

• replace caller-controlled qualification thresholds with one ordered repository release authority
• require skipped-case-named-binding and the exact 76-cell, two-provider grid
• share exact cells, IDs, seed, budgets, analysis, host policy, and catalog between runner and qualifier
• bind evaluator provenance to the generated transitive runner/qualifier dependency closure
• reject persisted catalog drift, old 70-cell plans, noncanonical evaluators, host overrides, and stale authority digests
• remove the legacy summary/merge qualifier path

Verification

• bun run check: 577 pass, 1 intentional live skip
• bun run replay: 13/13 matched
• focused policy/qualification/metadata tests: 29 pass
• three-model interrogate, deslop, and comment review: no remaining Phase 5 findings
• source ceiling unchanged at 892 bytes headroom

Boundary

Release remains frozen. Immutable qualification bundles and full verdict rederivation are intentionally the next Phase 7 and 8 units; this PR makes policy, plan, host, and evaluator authority non-configurable first.

[vriesd]

PASS+NOTES — independently verified exact PR head 0efc250dab52357d313890d90a61df424a9f02b1 (parent/base 537b235e59b1da478b51f322a63f74a4dbea5096) in isolated temporary worktrees; no merge performed.

• Parent caller-catalog authority confirmed by source inspection: qualifyV2 parsed input.catalogInput directly; parent qualification tests accepted arbitrary caller policy rows.
• Head focused policy/grid/host/evaluator/transitive-closure/metadata tests: 110 pass, 0 fail; includes required skipped-case-named-binding, exact 76-cell/two-provider grid, all policy/host/evaluator mutations, legacy summary rejection, and decision-record immutability.
• bun run check: 577 pass, 1 intentional skip, 0 fail; bun run replay: 13/13 cassettes matched.
• Budgets: source 254,084 / 254,976 bytes (892 headroom); maintained prose 89,972 / 91,000 (1,028 headroom); decision records 47,911 / 48,000 (89 headroom).
• Exact-head GitHub CI passed: check, dependency-audit, lint-workflows, live-smoke, platform-persistence (macos-latest), and platform-persistence (windows-latest).
• Push preflight passed; legacy PASS_RATE_THRESHOLDS, MIN_PROVIDERS, merge/summary authority paths are removed, and persisted catalogs are exact witnesses of repository policy rather than authority.

Note: local optional gitleaks scanning was skipped because gitleaks is not installed; all required deterministic and exact-head CI checks passed.