v0.8.0 — independent verifier required for DONE
A DONE now requires a 'verify' gate emitted only by verify_confirm.sh (independent re-execution), not just the implementer's own logged gates. Closes the fabricated-implementer-gate-PASS path on the honest route.