Enterprise evidence: add canary rollout and quality tripwires

[tcballard]

Why

A routing policy that looks promising in shadow mode still needs a bounded production rollout with automatic protection.

Scope

• Add stable deterministic canary assignment.
• Support percentage, workspace, key, and approved cohort canaries.
• Define latency, error, cost, and quality tripwires.
• Automatically stop or roll back a canary when a tripwire fires.
• Preserve an auditable record of rollout state and decisions.
• Prevent configuration races between replicas.

Acceptance criteria

• The same request identity receives stable cohort assignment.
• Canary traffic cannot exceed its configured exposure.
• Tripwire evaluation is fleet-wide and bounded.
• Rollback propagates across replicas within a documented interval.
• A failed evidence or telemetry subsystem fails safe without expanding exposure.

Parent: #146

Invariant

The scored model decision remains offline, deterministic, keyless, and explainable.