v3.9.0 — autopilot hardening, live-proof receipts

Every fix carries a receipt from the first live end-to-end /autopilot run (two tickets: coded by terra, reviewed by luna, runtime-verified, merged, board drained). Single-conductor lock; the machine owns the runtime verdict (agent FAILs the conductor's own verify can't reproduce are overridden); lean reviewer default (the orchestrator died docless in bounded unattended rounds — restorable via models.json agents.reviewer); evidence inside the project; /autopilot OPERATE section — the PRIMARY agent kicks off, tracks, and reconciles, with handoffs only where the HEAL ladder names one; dead-code tool detection now matches the harness probe (global binaries honored). 725 tests green under both tool PATHs.