[codex] add paired fit gates and admission

[divo12]

Stack

Depends on #9. Review against codex/ahe-candidate-editing.

Problem

Governed candidate patches are hypotheses, not improvements. OFW needs paired champion/candidate evidence, progressive developer gates, sealed selection, one-time admission, and recoverable rejection before a candidate may become a winner.

Implementation

• Adds FitCampaign with immutable typed FitPolicy.
• Revalidates candidate manifest identity, changed-file digests, frozen assets, exact Git diff, and patch digest immediately before execution.
• Reproduces the champion baseline before candidate evaluation.
• Runs candidate worktrees with champion execution/lifecycle/verifier fingerprints on exactly the same developer cases.
• Stores paired per-attempt pass, score, latency, typed cost, partition, synthetic weight, and criticality deltas.
• Excludes synthetic repeats from critical-regression counts and weights synthetic aggregate deltas.
• Applies incomplete-run, critical-regression, regression-score, target-delta, latency, and cost gates.
• Attributes actual quality/cost/latency results back to the frozen prediction manifest.
• Exposes selection holdout only to developer-gate survivors.
• Selects one Pareto finalist by selection score, target delta, then smallest patch.
• Rejects/cleans non-final survivors explicitly.
• Writes a typed running/completed/error admission record before exposing exactly one finalist once.
• Leaves only an admitted winner worktree open for promotion; all rejected candidates are discarded.
• Content-binds persisted fit results to a typed SHA-256 sidecar before accepting a retry.
• Freezes a canonical input digest over the harness revision, export bundle, policies, snapshots, and every candidate manifest/patch.
• Revalidates every persisted candidate artifact and each live worktree before accepting a cache hit.
• Uses deterministic policy/candidate-bound campaign IDs and returns an existing durable result on safe retry.

TDD evidence

• Planted frontier fix survives while a critical-regression candidate is rejected before selection.
• Rejected candidate worktree is removed; winner remains available.
• Winner passes selection and one-time admission with paired frontier delta.
• Candidate that passes developer gates but fails admission returns no winner and is discarded.
• Unmanifested candidate drift fails before baseline or holdout access.
• Campaign retry returns the same durable result without a second admission.
• Cached winner drift is rejected, and modified fit result bytes fail integrity validation.
• No-winner retries reject changed candidate artifacts and export snapshots instead of replaying stale evidence.
• Completed admission records bind the holdout result path and semantic digest.

Verification

• pytest -q — 126 passed
• Ruff and strict mypy across src and tests — clean
• forbidden construct scan — no Any, raw dict, object, getattr, setattr, lambdas, or __import__
• Bandit and deep security scan — zero findings
• pip-audit — no known vulnerabilities
• source distribution and wheel build successfully

Deliberate scope

• Promotion is not performed; the winner remains an isolated worktree.
• Scheduler, commit/PR creation, approval, deploy, and post-promotion monitoring remain later stack layers.