feat(crosscheck): make evidence execution conditional

[ruby-dlee]

Summary

• make Crosscheck evidence execution conditional on admitted proof-bearing review output
• preserve historical depth-contract compatibility while binding the current evidence policy and mode into reviewer identity
• retain failed paid evidence attempts as noncertifying diagnostics
• keep local and Azure identity validation fail closed

Parent-failing evidence

The parent required verdict-level executed reproduction, lacked the evidence-mode decision helper, and allowed current constants to alter historical depth validation. The release regressions fail on that parent and pass here.

Validation

• full core Crosscheck suite passed
• full Azure Crosscheck suite passed
• ledger compatibility suite passed
• syntax and diff checks passed
• all adversarial findings were fixed and regression-covered

Live checkpoint

• task cc-2a-v1-e616a585-20260826 reached semantic CLEAR, then failed closed while rendering the identity-only report
• the rendering defect was repaired and covered offline
• declared cost: $0.0122704; wall time: 444.566 seconds
• bounded retry cc-2a-v1b-e616a585-20260826 stopped before model dispatch after shared allocation wait
• retry declared cost: $0; wall time: 4,477.463 seconds

The checkpoint is parked under the approved retry policy. No merge is requested.