[codex] add governed AHE candidate worktrees

[divo12]

Stack

Depends on #8. Review against codex/benchmark-runner-baseline.

Problem

OFW has trustworthy clusters, exports, and a reproducible baseline, but no governed way to materialize an improvement candidate. A model-generated patch must not touch frozen files, escape the workspace, drift from its base digest, or revise its prediction after results are known.

Implementation

• Adds typed CandidateEvidence, ChangePrediction, CandidatePolicy, FileEdit, and LineRange contracts.
• Requires predictions to cite known cluster, eval-risk, component, and optional memory evidence.
• Hashes the complete prediction, policy, evidence, base digests, replacements, and selectors into candidate identity.
• Writes the immutable change manifest before creating/applying a worktree.
• Allows edits only to registered FIT_EDITABLE assets and policy-approved component classes.
• Requires source bytes to match both the edit’s expected digest and the processed revision asset digest.
• Enforces maximum changed files and bytes.
• Creates a deterministic isolated Git branch/worktree at the champion commit and reapplies the champion dirty patch.
• Overlays every processed asset so registered untracked/dirty files reproduce exactly.
• Rehashes every processed asset before worktree creation; unrelated editable drift makes the revision stale.
• Commits the materialized champion as a private baseline so candidate patches exclude pre-existing dirty state.
• Canonicalizes edit order so equivalent patch sets produce one candidate identity.
• Applies whole-file or exact line-range edits without shell evaluation.
• Verifies every frozen registered asset remains byte-identical after edits.
• Emits an immutable candidate patch and typed candidate revision.
• Rejects no-op edits and cleans worktree/branch state on failure or explicit close.

TDD evidence

• Minimal non-prompt tool edit succeeds in an isolated branch while frozen prompt remains unchanged.
• Manifest bytes remain unchanged after patch materialization.
• Frozen prompt, verifier file, and undeclared .env edits fail closed.
• Stale base digest fails before worktree creation.
• Line selector changes only its declared range.
• Unknown cluster/eval evidence fails.
• File/byte budget fails before worktree creation.
• No-op edit fails and leaves no branch/worktree residue.
• Equivalent multi-file edits in different caller order produce the same candidate ID.
• Unrequested editable drift rejects the revision; approved dirty state never appears in candidate.patch.

Verification

• pytest -q — 121 passed
• Ruff and strict mypy across src and tests — clean
• forbidden construct scan — no Any, raw dict, object, getattr, setattr, lambdas, or __import__
• Bandit and deep security scan — zero findings
• pip-audit — no known vulnerabilities
• source distribution and wheel build successfully

Deliberate scope

• Candidate proposal is an explicit typed patch request; model-provider orchestration is not duplicated here.
• Candidate evaluation, paired A/B gates, winner selection, scheduler, commit/PR promotion, and deploy are later stack layers.