Harden delivery gates and reframe checkpoint recovery

[whitelonng]

Summary

• add document-bound module delivery planning, evidence, review, and finalization gates
• enforce observation-surface requirements and prevent out-of-scope working-tree dependencies from producing false-ready results
• reject reused reframe checkpoint IDs before visible writes
• add controlled operation repair --replacement-checkpoint-id recovery for legacy checkpoint conflicts
• harden recovery payload provenance, checkpoint identity validation, reference rebinding, and retention ordering
• update CLI surfaces, adapter guidance, documentation, and contract coverage

Validation

• npm test (132 files, 1020 tests)
• npm run lint
• npm run typecheck
• npm run build
• npm run test:dist
• git diff --check