fix: harden restart QA DAG assertions

[numnx]

What changed

• Keep QA outcome assertions exact by default.
• Allow a repeated intermediate QA rejection only when durable timestamps and invocation IDs prove one complete restart-recovery cycle.
• Require the recovered coding completion to occur between the prior and repeated verdicts, plus a distinct repair completion before the next verdict.
• Reject late or unrelated recovery events, repeated terminal verdicts, reordered outcomes, and unexplained coding redispatches.
• Apply the same causal evidence to task-coding invocation-count assertions.
• Document the restart-aware QA DAG contract in canonical and public developer documentation.

Why

The Linux Docker DAG completed successfully through two forced runtime restarts, but CI rejected the valid QA history changes_requested → changes_requested → pass. A restart had recovered a completed follow-up invocation before its workspace repair was visible, so QA correctly requested the same change again before the next repair succeeded.

The previous test harness assumed exactly one rejection. This change recognizes that valid recovery path without weakening detection of genuine orchestration errors.

Validation

• pnpm exec vitest run tests/backend/scripts/mockup-sprint-pentest-runner.test.ts tests/backend/ci/workflow-health.test.ts — 46 passed
• pnpm run lint — passed
• pnpm run check:docs-web — passed
• Linux Docker restart DAG — passed three consecutive runs with two forced restarts per run
• Replayed the exact failed-job SQLite artifact — valid causal cycle accepted
• Negative coverage — late recovery event and post-pass spurious coding invocation rejected
• Independent code review — no blockers
• Full pnpm run ci — passed

Risk and rollback

Risk is limited to the mockup orchestration test harness and its documentation; production orchestration behavior is unchanged. Roll back commit 901c2ab5b if the stricter causal matching causes an unexpected test-only regression.