Add fail-closed seed43 target admission gates

[devin-ai-integration]

Summary

Add a standalone provider-free admission contract for repaired tool-use SFT targets, separate from lifecycle PR #465.

admitSeed43Targets(records, protectedFailureFamilies) now rejects:

• training/serving input serialization drift;
• the seed42 [16071, 95597, 11] collapse sentinel;
• action-required rows without exact tool-call name, decoded arguments, and effects;
• positive NO_ACTION text targets and action/no-action sign inversions;
• no-action dominance and missing protected failure families.

The focused regression suite covers the collapse sentinel, exact tool-call round-trip, serialization drift, sign inversion, and balance gates.

Link to Devin session: https://app.devin.ai/sessions/23d3bbcf33b34ddda0fb4f3ebbf16607

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring