feat(ratification): gate ratification record, unified completion authority, ruling trailer validation (#627 Stage 2)

[HenryLach]

#627 Stage 2 — TP-198 + TP-199 (Taskplane batch 20260907T194708)

First batch run on the Stage-1 held-state build (1bfe3e0c87cb). 2/2 succeeded, 13 reviews (Level 3, plan+code checkpoints), 0 relaunches, 0 holds opened — every finding was resolved in-authority; the spiral signal fired at 3 and 6 on TP-198 step 3 and was adjudicated by steer under a hard cap.

TP-198 — Gate ratification record + finalize binding

• ratification.ts / ratification-op.ts: GateRatification bound to task, segment, gate, released ruling, superseded-review sha256, immutable proof oid == HEAD, clean source tree (only STATUS/.DONE/.reviews exempt), staleness (later REVISE or newer review for the gate); unique ids per issuance; structural decoding of persisted records; fail-closed git probes.
• ratify_gate tool (supervisor stamp) and /orch-ratify (operator stamp — the only path); packet-home routing for cross-repo segments; allocation from the global review counter; audit entry gate_ratified.
• Finalize refuses a linked APPROVE without a valid, non-stale record → review_gate_refusal / invalid-ratification. Unlinked APPROVEs unchanged (feat(gate-integrity): task must not finalize succeeded while steps lack an explicit APPROVE in their review files #626 coverage gate is out of scope).

TP-199 — One completion predicate + ruling citations

• completion-authority.ts: authorizeCompletion() = holds → review gates → ratification, reporting all blockers; used by the live finalize path and resume's .DONE acceptance with the same working-tree drift probe.
• ruling-trailer.ts: Taskplane-Ruling: <id> trailer parsing + validation against the hold table; unknown id / wrong unit / prose claims → STATUS line + audit entry ruling_citation_flagged + one alert per iteration; never changes task status. Worker template documents the contract.

Validation

Both tasks ran the full suite, typecheck, lint (283 baseline held), format and CLI gates in their Step 4; both wave merges ran tests. Review files are in each task's .reviews/.