EPIC-0459 enforce semantic evidence admissibility

[epowell40]

Summary

• reproduce Candidate 3 false completion before repair
• separate operation topology, fulfillment role, Observation evidence class, and typed fact admissibility
• deny criterion inheritance by default and require exact delegated task execution
• preserve structured schema-correction gaps without allowing control evidence to complete task criteria
• publish one shared V2 session-index contract across producer and collectors
• regenerate certification and trust artifacts

Validation

• operator-backend: 2882 tests, 2879 passed, 3 skipped, 0 failed
• MCP compiled corpus: 218 passed, 0 failed
• Revit 2023-2026 compatibility builds passed
• OperatorDeploy: 192 passed, publish succeeded
• repository/kernel boundaries, generated certification/exposure checks, module-size ratchets, and secret fallback scan passed