Deliver M4 policy and project guidance

[xeonvs]

Summary

• deliver M4 structured target-branch accepted decisions and bounded nested project guidance through the existing read-only evidence MCP
• preserve the single collector/store/bootstrap/MCP lifecycle while decomposing collectors and persistence by responsibility with extract-and-delegate moves and compatible package facades
• qualify OCR 1.9.3, refine GitLab review presentation, simplify agent-instruction ownership, and harden evidence redaction, snapshot, delta, include-graph, and atomic-write boundaries

Tracks #81; it remains open until the separate stable 0.6.0 delivery and immutable release receipt. OCR qualification issue #82 remains open until merged support and development artifacts are independently read back.

Validation

• scripts/quality.sh check (766 passed, 99 subtests, 81.12% branch coverage)
• Python 3.12.14, 3.13.15, and 3.14.7 full matrices
• Installed wheel and sdist-to-wheel policy/MCP E2E (376 passed, 49 subtests)
• Reproducible 0.6.0.dev0 wheel and sdist, Twine, lock, dependency audit, and package-layout checks
• OCR 1.9.3 compatibility manifest, Towncrier draft, workflow/example YAML, changed-shell syntax, and diff hygiene
• Codex Security exact-head scan completed with zero findings before OCR remediation
• Two authorized local OCR 1.9.3 reviews at concurrency 2; the second completed 31/31 and all nine findings plus sibling classes have negative tests
• Staged and full first-parent Gitleaks; private-marker scan
• User-visible change has Towncrier fragments
• Examples and fixtures are synthetic
• No credentials, private hosts, paths, or provider payloads are included

Changed boundaries

• Policy parsing and trust: evidence.policy owns closed decision/guidance contracts, safe scopes, applicability, staleness, and target-only provenance. Collector, hostile-store, bootstrap, and MCP tests cover source-ref self-authorization and malformed/oversized isolation.
• Immutable Git collection: evidence.collectors keeps one public facade and one-ref transaction while extracted registry, source projection, include-graph, and projection modules point downward. Characterization and architecture tests protect parity and forbidden upward dependencies.
• Persistence: evidence.store keeps the supported public imports while extracted contracts, recursive normalization, atomic replacement, and hostile readback reject ambiguous redaction, invalid schema/index state, and unsupported indirection.
• Reporting and upstream compatibility: posting owns one outcome line plus opt-in normalized finding badges with a private-safe text fallback; the checksum-pinned 1.9.3 evidence records consumed compatibility separately.
• Repository process: canonical engineering/development/release owners replace duplicated imperative pitfalls; executable subsystem gates remain at their actual boundaries.

Security and compatibility impact

• No runtime dependency, dynamic plugin loading, new service, second MCP lifecycle, or new user configuration is introduced.
• Repository policy is immutable target evidence, not authorization; source changes cannot self-whitelist a review.
• Recursive redaction handles mapping keys before sensitive-name classification and rejects collisions rather than overwriting values.
• Evidence store schema v3 is exact and hostile-readback-safe; historical v1/v2 remain explicitly bounded.
• OCR 1.9.3 is the qualified recommended external binary; additive retry data remains private and badges are presentation-only.