Harden resumable benchmark execution and evidence integrity

[brunovicco]

Problem

Long-running live benchmarks could be interrupted after incurring substantial
provider cost. Resume behavior did not consistently preserve completed strategy
checkpoints, event-log continuity, experiment labels, or the original run
identity.

The benchmark also needed a deterministic question limit to control evaluation
costs, and the evidence checksum flow introduced a circular dependency between
the manifest and the final evidence root.

Solution

Make live benchmark execution cost-controlled and safely resumable while
strengthening evidence generation and verification.

Main changes

• Add deterministic stratified question sampling with a configurable
  max_questions.
• Resume only complete strategy checkpoints and atomically replace strategy
  records.
• Preserve canonical experiment labels such as sparse_bm25.
• Reuse a persistent asynchronous event loop for RAGAS judge workers and close
  provider clients explicitly.
• Continue event sequence numbers and hash chains when resuming a run.
• Preserve the original run manifest, start timestamp, and Git revision.
• Validate run identity before accepting an existing checkpoint.
• Remove the circular dependency from final evidence checksum generation.
• Extend the offline verifier to validate the evidence root.
• Reject dirty worktrees while allowing known untracked benchmark output
  directories.
• Document embedding models and retrieval strategies in English and Portuguese.
• Update ADR-0017 to describe the revised evidence lifecycle.

Test evidence

• Full quality gate passed.
• 516 tests passed and 20 were deselected.
• Coverage: 83.17%.
• Ruff lint and formatting checks passed.
• Strict Mypy checks passed.
• Architecture and governance checks passed.
• Bandit and dependency audit passed.

Security and data considerations

• No credentials or provider payloads are added to the repository.
• Generated benchmark artifacts and experiment outputs are excluded from this
  pull request.
• Existing metadata-only observability behavior is unchanged.

Operational and rollout considerations

Existing completed outputs should not be treated as resumable unless their
manifest identity and strategy checkpoint completeness pass the new validation.

The benchmark sample remains deterministic for the configured seed, allowing
comparable reruns while limiting provider costs.

Risks and follow-ups

• Previously generated runs using the older evidence checksum lifecycle may not
  pass the strengthened verifier.
• Local Hugging Face model revisions are still not pinned immutably.
• The canonical judge still requires the planned human-calibration exercise.