[codex] Govern SSWP witness calls

[VrtxOmega]

Summary

Adds governed SSWP witness metadata so sswp_witness can be called after Omega Cortex and carry cortexVerdict plus traceId through to the shared event bus.

What Changed

• Add optional traceId and cortexVerdict fields to sswp_witness.
• Emit SSWP_WITNESS_COMPLETE shared events with Cortex governance metadata.
• Emit SSWP_CORTEX_NOT_CHECKED when a witness is run without a prior Cortex verdict.
• Add sswp_export_to_omega to format latest or repo-specific attestation evidence as an omega_seal_run payload.
• Update the precompiled dist/sswp.cjs runtime to match the source-level behavior.

Verification

• npm run build confirms this package's dist is precompiled/no-op.
• node --check dist/sswp.cjs
• MCP protocol smoke confirmed sswp_witness exposes cortexVerdict and traceId, and sswp_export_to_omega is listed.
• Disposable fixture witness with traceId=VT-CODEX-SSWP-PR-20260529A and cortexVerdict=APPROVED returned Cortex: APPROVED and no CORTEX NOT CHECKED warning.
• Shared event ledger contained SSWP_WITNESS_COMPLETE with cortex_governed=true, cortex_verdict=APPROVED, and no SSWP_CORTEX_NOT_CHECKED for that trace.

Notes

Draft PR for review. This is intentionally scoped to SSWP witness governance and Omega export support.

[VrtxOmega]

CI note from Codex:

The failing build check is the Datadog Synthetics workflow, and it fails before project code executes:

Missing API or APP keys to initialize datadog-ci!
Error: Input required and not supplied: api_key

Local verification for this PR passed:

• npm run build (repo build script confirms dist/ is precompiled)
• node --check dist/sswp.cjs
• MCP protocol smoke confirmed sswp_witness exposes traceId and cortexVerdict
• MCP protocol smoke confirmed sswp_export_to_omega is listed
• Disposable governed witness with traceId=VT-CODEX-SSWP-PR-20260529A and cortexVerdict=APPROVED produced SSWP_WITNESS_COMPLETE with cortex_governed=true and no SSWP_CORTEX_NOT_CHECKED

I am not changing the workflow in this PR because that is a separate repository-secret / CI-policy issue.

[VrtxOmega]

Follow-up on the export bridge: I found and fixed one issue before marking this ready for review. sswp_export_to_omega was using the risk-sorted health-board view, which does not expose repo_path, so explicit repoPath export could fail and default export was not truly latest-attestation based.

Updated in fd8b124:

• export by repoPath now uses getNodeByPath() + getLatestAttestation()
• default export now selects the most recent attestation across registry nodes
• source and committed dist/sswp.cjs were updated together

Additional local verification passed:

• npm run build
• node --check dist/sswp.cjs
• MCP stdio smoke for sswp_export_to_omega with explicit fixture repoPath
• MCP stdio smoke for default latest export

The remaining GitHub check failure is still the Datadog workflow secret/config blocker (api_key missing before project code runs).