fix(eval): require trusted execution evidence

[avabbbb]

Why

The current live-eval grader can infer an Operation from shell text alone. A synthetic trace containing echo "python -m app.cli run get_profile" can therefore look like execution even when the Operation Registry never ran.

The product critique also found that an unknown outcome criterion is currently silently accepted.

What changes

• split Trace.requested_operations from trusted executed_operations
• derive executed Operations from successful per-trial OperationAuditLog rows in the runner
• grade operations_used as request ∩ trusted audit receipt
• write requested/executed/used operation sets separately into operations.json
• fail closed on unknown outcome criteria with INVALID / grader_bug
• add negative-control regression tests for:
  • echoed CLI text without audit evidence
  • unknown grader criterion
• update grading docs to make the trust boundary explicit

Non-goals

• no change to Career Truth or Operation Registry semantics
• no runtime/provider redesign
• no product UX changes
• no change to protected-action confirmation

Verification

This PR is intentionally opened as Draft first. Repository CI should verify the focused eval tests and broader regression suite before it is considered mergeable.

The key invariant is:

Agent text may prove what it requested; only trusted runner/audit evidence may prove what OfferU actually executed.

[avabbbb]

CI note: current GitHub Actions failures are not limited to this PR's changed files.

Observed repository-baseline blockers on the PR runs:

• frontend npm ci stops before typecheck/build because frontend/package.json and package-lock.json are out of sync (missing @emnapi/core, @emnapi/runtime, @emnapi/wasi-threads, @react-spectrum/provider)
• backend full suite also has existing environment/repository failures on unchanged areas (Windows H:/tmp/offeru paths on Linux runner, missing interview-scoring rubric asset, unavailable local runtime assumptions)
• extension tests and RustSec also currently fail independently of this PR

Therefore this PR remains Draft. Its own changed-path verification should be reviewed separately from the current repository-wide CI baseline; no claim of a green full suite is being made.

[avabbbb]

Superseded by ef30fcc (adversarial-optimization Stage B). Main now grades real execution from operation_audit_logs via a grade(audit_rows=) path — self-reported app.cli run X echo no longer proves execution, and the six negative controls pass (echo-claims-op → FAIL, text-only confirm → no gate). I did absorb this PR's more accurate unknown-criterion classification into 490c322 (INVALID/grader_bug rather than an in-line criterion fail). The conflicting files (grader.py/runner.py) have moved on, so closing rather than resolving.

[avabbbb]

Follow-up audit (2026-09-23): the important trusted-execution invariants from this closed PR are already present on current main. The grader derives actual executed Operations from OperationAuditLog rather than trusting command-shaped trace text, and unknown outcome criteria fail closed as INVALID / grader_bug. PR #16 now documents this boundary in docs/evals/GRADING.md, so this PR should remain closed rather than be revived wholesale.