Bind Janus invariants REC-witness-minimum, COV-adjudicators, COV-operators-adjudicate

[csecrestjr]

Adds three registry-bound tests (one new file each in internal/dispute and internal/consumerapi; internal/record's file gains a third test).

• COV-operators-adjudicate: only a threshold of the platform Charter's adjudicators resolves a case; parties, witnesses, strangers refused; rulings platform-bound; Registry API pinned; StateResolved set in exactly one place.

• COV-adjudicators: both parties rate the operator's adjudication conduct; strangers, non-parties and the operator itself refused; ratings stay their own distribution; only the operator answers. Residual: the witness-as-adjudicator half awaits cross-platform witness adjudication (not built). Reviewer's call whether to count this as bound now.

• REC-witness-minimum: the unfederated label is computed and stays on unless two verified, operator-independent witnesses cosign; every served checkpoint carries it, set from StandIn(...). Named exception: the relay's BundleMsg (readers compute, by design).

22 planted violations, all caught. Finding: the dispute Registry does not bar an adjudicator from ruling on its own case (COV-operator-dispute-witnesses, instrument-bound).

Janus --bindings: 10 of 23 implementation-bound invariants bound.

[NetworkTheoryAppliedResearchInstitute]

Tested at 0da0d5e: CI green, all commits signed off; build, vet and gofmt clean; full suite passes (Linux container for packages Windows blocks). Janus --bindings against this branch gives 10 of 23 bound.

Planted 18 violations across the three new tests: COV-operators-adjudicate (threshold, platform, signature check, second StateResolved site, new exported Registry method), COV-adjudicators (non-operator rated as adjudicator, non-party rating, anyone answering, adjudication pooled into trade, operator rating itself with the general self-assessment ban also removed), REC-witness-minimum (operator as own witness, unverified or duplicate cosignature, one-witness threshold, hard-coded served label, served struct without stand_in). All caught, by these tests or by an existing package test.

Confirmed the named finding with a probe: a complainant on the Charter roster can co-sign a 2-of-2 ruling in its own favour and Rule admits it (COV-operator-dispute-witnesses, instrument-bound, out of scope here as CONFORMANCE.md states).

Approved.