Harden WebMCP evidence staging and semantics

[Cuuper22]

Final challenge hardening after live-browser red-team validation.

• Keeps the state discovery result below the 1,500-character WebMCP budget
• Replaces free-form agent conclusions with the artifact's typed conclusion code
• Requires optimistic concurrency and refuses pending-review overwrite
• Separates support-envelope flags from controller-only abstentions
• Labels WEBMCP, LOCAL TOUR, and HUMAN receipts explicitly
• Opens full-trace evidence at a visible depth
• Adds a flagship multi-tool eval trajectory and transition-focused run slice

Verified with focused Python contract/projection tests and Node runtime tests.