docs(FAFF-328): trial runbook + TrialRecord scaffold for Channel A live-run validation

[alechill]

Summary

Prepares the FAFF-328 live-run trial per its spec's Execution-mode design decision: an
autonomous graft may prepare the runbook and seed materials, but the launch step is
human-initiated by design (the run invocation is itself the authorization). This PR delivers
the prep half only — the trial has not been run.

• docs/specs/2026-07-12-FAFF-328-live-run-validation-of-channel-a-corrective-authority-design.md — the spec, committed per the graft prep-gate step (spec-review: approve on Linear FAFF-328).
• docs/trials/2026-07-12-FAFF-328-live-run-validation-of-channel-a-corrective-authority/runbook.md — preflight results as run from this dev worktree today, the seed-issue draft, launch/observe/teardown/record procedure for the human who runs the trial.
• docs/trials/2026-07-12-FAFF-328-live-run-validation-of-channel-a-corrective-authority/trial-record.json — the unfilled TrialRecord scaffold (spec section 3 shape) to be filled during the trial's Record step.

Preflight findings (this dev worktree, not the trial container)

• 0a (integrity asserted) — asserted:false, basis:no-declaration — expected outside a cage launch.
• 0b (capability flag) — faff lights-out --check --json currently refuses for three reasons, only one of which (corrective-integrity, no FAFF_INTEGRITY_BOUNDARY declaration) is the expected "needs a real cage launch" condition. The other two are pre-existing repo dial-coherence gaps unrelated to this trial (slots.spec_review is the single-pass default, not adversarial; gates.fallback is advisory, not fail-closed) — both would block any L4 lights-out launch today, trial or otherwise. Recorded as discovered scope rather than fixed here (a production config change is outside a docs-only trial-prep ticket).
• 0c (surface present) — pass. FAFF-326's shipped corrective CLI region + correct sentry rung match the spec's Assumes exactly; no runbook rebind needed.

Acceptance Criteria

• Runbook prepared per spec HOW procedure step 0 (preflight) — Verified: faff corrective-integrity --json, faff lights-out --check --json, faff corrective/corrective check/corrective author usage probes, grep SENTRY_INTERVENTIONS — all captured in runbook.md section 0.
• TrialRecord scaffold matches the spec's RECORD shape (section 3) — Verified: trial-record.json fields mirror the spec's RECORD TrialRecord block 1:1.
• Seed materials drafted (not created live) — Verified: runbook.md section 1 carries the seed issue title/labels/spec-engineering guidance.
• ADR-0039's provisional-GO caveat discharged by a recorded verdict — Needs human trial launch. This PR intentionally does not discharge the caveat; that is the trial's own outcome, not prep's.
• Every checkpoint 1–8 has an observed value with evidence — Needs human trial launch. trial-record.json is scaffolded, unfilled by design.
• Trial ran as one human-initiated bounded run — Not run. This is the parked step.

This is a docs-only PR (the FAFF-278 spike-deliverable shape) — no production code ships, per spec §8 "From tests".

Why parked (not merged/shipped)

Per the FAFF-328 spec §6 "Execution mode — autonomous graft vs human-initiated window?": "Chosen: a human-initiated trial window (the run invocation is the human authorization — the FAFF-278 human-supervised spike precedent) ... an autonomous graft may prepare the runbook and seed but parks at the launch step with cause 'trial window needs human launch' — expected and by design."

FAFF-325 and FAFF-326 (this ticket's blockers) are both shipped and merged (PR #328, PR #329) — confirmed via Linear + git log/git merge-base. This PR is not blocked on missing dependencies; it is deliberately parked at the launch step per the spec's own design.

Test plan

• faff gates run --json → {"signal":"pass","discovery":"none"} (docs-only diff)
• Human: review the runbook, resolve or consciously accept the two dial-coherence gaps named in section 0, create the seed issue from the draft, launch the trial per the runbook, fill trial-record.json, and land ADR-0039's verdict entry as a follow-up PR.