v1.3.9

v1.3.9 - Deeper measured evolution, safe web research, and auto-updater idempotence

• Evidence-fed evolution loops are bounded and externally gated: evolve_until_stable stops within max generations or stagnation patience, records observation history, rejects non-callable evaluators, and marks receipts as requiring external acceptance before any evolved state ships.
• Web research hardening: scraper base improvements and safe GET-form submission handling.
• Auto-updates no longer rewrite bundled cortex seeds on no-op applies: the cortex merge is write-on-change idempotent, so source checkouts and installed trees stay byte-stable unless preserved experience is actually folded in. This removes the mid-test-run source-tree contamination observed during the v1.3.8 Windows investigation.
• Regression coverage for no-op and meaningful merges, including an end-to-end git apply_update test.

Full CI: 10/10 jobs green (Ubuntu, macOS, Windows x Python 3.10-3.12 + policy probes).