feat: add M01 playable simulator vertical slice

[tim8es]

What this adds

• playable M01 mission at #/mission/m01 with four deterministic decisions, project meters, consequences and trajectory review
• M01 course/validation entry routing to the mission
• isolated simulator storage: pm01-sim-m01-v1
• validation evidence gate pinned to m01-mission-partner-launch-v1 / version 1
• legacy two-lesson completion can no longer unlock post-case; exact completed simulator evidence plus final review is required
• simulator-specific accessibility/reduced-motion contracts

Rationale contract fix — RED → GREEN

Confirmed defect: simulator accepted any non-empty D1/D4 rationale while validation required at least 8 trimmed characters.

• RED commit: e48a6a80572cc72c03bbc2fa6c2c3d4b2c6713a1
  • added regression for < 8 characters
  • CI failed as expected
• GREEN runtime commit: c999029e68d37c76912a04afd9cd41a2be5f12a9
  • domain now uses the same trimmed length >= 8 contract for commit and completion
• final evidence-only test commit: ca37ceda4428dc8739f9dd400b0772b393be330a
  • verifies rejected rationale leaves decisions[] and decisionIndex unchanged

Final PR head: ca37ceda4428dc8739f9dd400b0772b393be330a

Verification

PR merge-ref CI job 103104405493: PASS

• root *.js syntax check: PASS
• full suite: 56/56 PASS
• 0 failed, 0 skipped

Controlled GitHub Pages deploy

Owner-authorized runtime-only deploy completed without merging this PR.

• previous gh-pages: c4f8ac2af6a66efdb79881baa58d4c091a0e6aed
• deploy commit: 54e63463c5ffa55e55afe22555ce20c487964936
• Pages workflow run 34547850804: SUCCESS on exact deploy SHA
• deploy diff: exactly 7 runtime files (index.html, simulator data/domain/app/routing/CSS, validation simulator gate)
• no tests/docs/CI copied to production

Live mission: https://tim8es.github.io/pmo01/#/mission/m01

Scope guardrails

• PR is not merged
• main is not changed
• no M02 files changed
• no telemetry changes

Browser QA

Browser-level interactive walkthrough is UNEXECUTED in this agent session because no controllable browser/CDP runtime is available. Static/domain/integration verification does not substitute for that check.