[P1 governance] Differential parity negative controls are incomplete and can regress silently

[bhelm]

Confirmed gap\n\nThe differential registry contains substantially more operations than the durable negative-control suite. CI runs generated negative cases but has no fail-closed, merge-base-ratcheted registry that ensures negative-control coverage cannot shrink or that newly registered differential operations receive a negative probe or explicit issue-bound rollout state.\n\n## Acceptance\n\n- Check in a durable negative-control baseline/registry.\n- Ratchet it against merge base so coverage cannot decrease.\n- Require every new differential operation to have a negative probe or a new exact issue-bound rollout entry.\n- Wire the check into always-on CI with serial/RAM-bounded workflow behavior.\n- Do not manufacture dozens of meaningless mutants; preserve an honest issue-bound rollout path.\n\nTracks harness/tooling only; no production behavior change.