local stratified cohort planning from materialized traces

[Anirudh2627]

Adds understudy evals stratify, a local, metadata-only cohort planner that derives configurable strata from completed-execution behavior in the trace-foundry artifacts (execution-index.jsonl + tasks.jsonl) and selects a deterministic, stratified cohort toward decision-sized per-stratum targets.

Strata axes (in greedy priority order): outcome, mode, turns, confidence, tag. mode (write vs read-only vs no-tools) reuses the foundry's own isMutatingTool classifier so selection and replay agree on what is a write. tag strata are human-supplied only (--tags file) — never auto-inferred.

Guarantees
Deterministic. Same seed + same inputs ⇒ byte-identical plan (SHA-ordered selection). Covered by test.
Pilot sizes are minimums, never caps. Rare strata (≤ --rare-threshold) and human-tagged high-consequence strata are saturated, so every available rare or high-consequence case is included.
Incremental expansion without mutating frozen splits. --expand-from preserves every prior selection and reports whether the new batch shifted stratum prevalence within --tolerance (stable / unstable, machine-readable). Readiness is machine-readable. Underfilled rare/high-consequence strata populate blocking[] and set ready: false, so later gates can block a whole-workload-ready status.
Privacy-hard. The plan carries execution ids, labels, and counts only — never prompts, completions, or task payloads. The module deliberately does not read payload-derived fields (e.g. task title), and a test asserts no payload text can leak into the artifact.

New artifact
understudy.eval-cohort-strata-plan.v1 (schemas/understudy.eval-cohort-strata-plan.v1.schema.json), validated by a zod contract in src/evals/cohort-strata.ts and a schema-drift case in tests/artifact-contracts.test.mjs.

Scope
CLI + local contract only. No server API changes, no payload handling, no upload — in line with the issue's "server catalogs stay metadata-only; payload-derived classification runs locally" guidance.

Testing
tests/cohort-strata.test.mjs — 8 tests: derivation, byte-determinism, minimums-not-caps, payload redaction, frozen-expansion stability, unstable prevalence detection, blocking readiness, and an end-to-end CLI run. Full existing suite run; the only failures reproduce on clean main in this sandbox (GEPA/uv, gateway-fallback, and $HOME path tests) and are unrelated.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.