Emit bounded provider progress during long dual reviews

[BaseInfinity]

Goal

Make healthy long-running dual reviews visibly distinguishable from stalled processes without changing certification semantics.

Scope

• Emit bounded lifecycle events: provider started, provider completed, reconciliation started, and receipt written.
• Emit a low-frequency heartbeat while a provider is still running.
• Keep output free of prompts, repository content, secrets, and model reasoning.
• Preserve the existing timeout, cleanup, and verdict rules.

Acceptance criteria

• A slow successful fixture emits at least one progress event before its final receipt.
• A fast run does not produce noisy repeated heartbeats.
• Progress identifies the provider and phase without exposing reviewed content.
• Progress output cannot be mistaken for a review verdict or certification receipt.
• POSIX and Windows fixtures cover termination and output ordering.

Boundary

This is post-1.0 observability/UX work. Release-blocking failure classification and partial non-certifying receipts remain in #157.

[BaseInfinity]

Measured consumer evidence: healthy Fable review was silent for 222 seconds

An exact-candidate standalone claude-fable-5 high review in BaseInfinity/m180-jumpseat completed successfully after 222,303 ms, 24 turns, with verdict CLEAN and no permission denials. During the run, the controller emitted no provider/phase progress, so the consumer had to poll every 30 seconds and narrate that absence of output was not yet evidence of a stall.

This directly supports the proposed low-frequency heartbeat. A useful event needs only:

• provider/model lane;
• phase (preflight, review, receipt);
• elapsed time;
• child still supervised;
• last structural event time.

It must not expose prompts, repository content, reasoning, or provisional verdicts. One event around 30-60 seconds and then a low-frequency cadence would have made this healthy four-minute review self-explanatory.