feat(gate): add machine-owned assurance envelopes

[screenleon]

Summary

• add a versioned machine-owned gate assurance envelope for tier, mode, pass kind, reviewer coverage, independence, and dispatch evidence
• bind v2 assurance to the result digest, repository identity, base/head commits, subject fingerprint, protected attestation, and canonical terminal run records
• preserve legacy v1 readability while reporting assurance as unavailable, and generate the copy-mode verifier fallback from the shared verifier
• harden sidecar-first atomic publication and refresh the isolated profile fixtures for the new runtime dependencies and truthful parallel synthesis mode

Why

Gate Markdown previously mixed human reviewer findings with machine-consumed authorization claims. That made execution topology, coverage, evidence binding, and reviewer independence difficult to validate independently and fail closed.

Validation

• Authoritative full suite: 97 passed, 0 failed, 0 skipped
  • tests/bin/run-all-tests.sh --result-file /tmp/cc512-full-result-current.json
• Full-result verification: authoritative PASS on HEAD 48808e3
  • tests/bin/run-tests.sh --verify-full /tmp/cc512-full-result-current.json
• Profile fixture regression: 13 passed, 0 failed
  • bash tests/shell/test-pr-gate-profile.sh
• Formal PR gate: GO, full tier, machine assurance verified
  • gate-20260727-060030-ab15f8

Sequential remains the default gate mode; parallel remains an explicit opt-in topology.