feat: resolve pixel-verify identity gate from deployment runtime config

[abrichr]

What

The pixel-compare identity tier's VERIFY branch (identity ladder tier 2) is gated by verify_pixel_identity(..., enable_verify=...), which defaults to the module constant PIXEL_VERIFY_ENABLED (False). The engine had no way to arm it from the deployment's effective runtime config — the gate was effectively pinned to the module default at every replay call site.

This wires the gate to the resolved runtime posture, with a safe default (off = exactly today's behavior):

• Add pixel_verify_enabled: bool = False to RuntimeSection (deployment.yaml -> runtime.pixel_verify_enabled).
• Thread it through build_replayer(...) -> Replayer(pixel_verify_enabled=...) and the CLI (_configured_replayer / _build_and_run_replayer / _replay_desktop) + attended-service wiring, the same way durable / allow_model_grounding are already threaded.
• The identity ladder's pixel_tier now calls verify_pixel_identity(..., enable_verify=self.pixel_verify_enabled).
• Document the key in docs/deployment.example.yaml (off by default, evidence-gated; MISMATCH/ABSTAIN unaffected).

Safety / behavior

• No behavior change when unset: the config default is False, and the Replayer passes an explicit False, which matches the module default today. MISMATCH and ABSTAIN paths are untouched — they can only ever add a HALT, never grant a pass.
• verify_pixel_identity's enable_verify parameter (added upstream in feat(identity): jitter-robust pixel identity VERIFY (config-gated, default off) #172) is unchanged; this PR only supplies it from config instead of leaving it at the module default.
• The two tests pinning PIXEL_VERIFY_ENABLED is False (test_compile_identifier_crop.py, test_identity_ladder.py) still pass unchanged.

Tests

New tests/test_pixel_verify_config.py:

• RuntimeSection().pixel_verify_enabled is False (safe default).
• load_deployment of runtime: {pixel_verify_enabled: true} -> True; absent -> False.
• Behavioral: an otherwise-matching crop ABSTAINS with the gate off and VERIFIES with it on; a real localized-glyph mismatch still HALTs either way.
• The resolved config reaches Replayer.pixel_verify_enabled.

python -m pytest tests/test_pixel_verify_config.py tests/test_identity_ladder.py tests/test_compile_identifier_crop.py tests/test_cli_deployment.py tests/test_attended_actions.py -q -> 94 passed. ruff check clean on changed files; mypy clean on changed files (one pre-existing unrelated error in benchmark/dom_arm.py, untouched here); claims validator passes.

🤖 Generated with Claude Code

https://claude.ai/code/session_01NyCHrzA1psrKMFfroYbzaM