feat: close evidence instruments and add bounded recovery

[shrec]

Summary

• explicitly close and regression-verify the 16-item evidence/economics instrument set
• add bounded, non-executing MCP recovery guidance for hallucinated tool names
• add line-movement-stable root-cause fingerprints and duplicate summaries to static scanner evidence
• document the source-pinned Strix capability review without importing upstream code or parallel authorities
• bump release projections to 0.8.99

Evidence

• Python: 2027 passed, 27 skipped
• evidence-instrument closure suite: 175 passed
• extension suite: passed, 29 files
• Ruff: passed
• Source Graph, semantic-edit, and context-envelope benchmark checkers: passed
• wheel, sdist, Twine, and VSIX packaging: passed

Truth boundaries

• implementation closure does not fabricate risk-precision or A/B populations
• unknown-tool suggestions never alias or execute a tool
• root-cause grouping never upgrades static candidates to runtime-validated findings

Workspace hygiene

The two pre-existing B829 eval files remain uncommitted and are excluded from this PR.

[Copilot]

Pull request overview

This PR bumps AIWorkHub to 0.8.99 and tightens “evidence-first” behavior by (1) making MCP unknown-tool failures recoverable with bounded, deterministic guidance, and (2) adding stable root-cause fingerprints plus duplicate summaries to static Known Bug Scanner evidence (including SARIF output), alongside roadmap/changelog documentation.

Changes:

• Add unknown_tool_message() and wire it into both stdio MCP dispatchers so unknown tools return bounded JSON recovery guidance and suggestions (no auto-aliasing/execution).
• Extend Known Bug Scanner output with root_cause_fingerprint, dedupe_summary, and SARIF partialFingerprints.aiworkhubRootCauseFingerprint.
• Version bump and documentation updates (Strix capability review, roadmap and changelog).

Reviewed changes

Copilot reviewed 15 out of 16 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
vscode-extension/package.json	Bumps VS Code extension version to 0.8.99.
vscode-extension/package-lock.json	Aligns lockfile package version to 0.8.99.
vscode-extension/extension.js	Updates expected MCP package version constant to 0.8.99.
src/aiworkhub/_version.py	Bumps Python package version to 0.8.99.
src/aiworkhub/tool_recovery.py	Introduces bounded unknown-tool recovery message generator.
src/aiworkhub/stdio_fastmcp.py	Emits bounded recovery JSON for unknown tools in dependency-free stdio server.
src/aiworkhub/server.py	Emits bounded recovery JSON for unknown tools in fallback stdio dispatcher.
src/aiworkhub/known_bug_scanner.py	Adds stable root-cause fingerprints, dedupe summary, and SARIF partial fingerprint.
src/aiworkhub/quality_evidence.py	Includes dedupe summary in known-bug evidence check summary.
tests/test_tool_recovery.py	Tests determinism, boundedness, and redaction behavior of unknown-tool guidance.
tests/test_stdio_fastmcp_schema.py	Ensures unknown-tool errors don’t terminate subsequent stdio requests.
tests/test_known_bug_scanner.py	Validates fingerprint stability across line movement and dedupe summary correctness.
tests/test_aiworkhub_embedded_mcp_runtime_b844_v1.py	Validates bounded unknown-tool behavior in embedded stdio protocol dispatch.
docs/STRIX_CAPABILITY_REVIEW.md	Documents source-pinned Strix capability review and adopted/non-adopted ideas.
docs/PRODUCT_ROADMAP.md	Notes evidence-instrument closure and documents Strix-derived refinements.
CHANGELOG.md	Adds 0.8.99 release notes describing the new recovery/fingerprint behavior.

Files not reviewed (1)

• vscode-extension/package-lock.json: Generated file