fix(decision-council): require advisor completion evidence

[9uiLe]

Summary

• add a host-neutral completion guard for supervised advisor dispatches
• require exact task, dispatch, sender, and worker_done identity matching
• require persisted-store observation and auditable collection finalization evidence
• reject completed dispatches with missing, stale, duplicate, or unrecoverable advisor output
• capture report content instead of trusting a report-path existence flag
• distinguish NOT_APPLICABLE transports without granting synthesis authorization
• run every Decision Council guard suite in CI

Scope

This is a consumer-side safeguard in Decision Council. It prevents a phantom advisor result from entering challenge or synthesis. It does not claim to repair Orca runtime transaction atomicity or prove upstream persistence beyond the normalized adapter evidence.

Decision Council dogfood

• froze O1 completion authority, O2 result recoverability, and O3 host neutrality
• used fresh Fable 5 and Codex gpt-5.6-sol/high sessions
• both recommended a standalone collection-boundary guard
• incorporated challenge findings for snapshot races, unknown transport/status bypasses, report-path TOCTOU, persistence overclaiming, and missing CI coverage

Testing

• node --test plugins/second-opinion/tests/*.test.mjs
• python ~/.codex/skills/.system/skill-creator/scripts/quick_validate.py plugins/second-opinion/skills/decision-council
• ./scripts/verify-versions.sh
• git diff --check

Closes #57