feat: consume head-bound runtime verification receipts

[Wibias]

Summary

Adds the first GitHub Delivery consumer layer for project runtime-verification evidence.

• adds a deterministic runtime receipt classifier with pass_current, stale, fail, blocked, and invalid-input semantics
• requires exact repository identity and full 40-character HEAD binding
• rejects malformed positive receipts, failed cleanup, and non-passing checks
• adds focused unit coverage for current, stale, fail, blocked, repository mismatch, and malformed SHA cases
• adds GD-RUNTIME-001 as a conditional policy module
• activates the module only for create-pr-for-issue when a project verifier exists and the candidate changes observable runtime behavior or has material runtime risk
• keeps tests, CI, proactive contract verification, and runtime evidence as separate evidence classes
• does not generate or repair project verifiers inside GitHub Delivery

Rollout boundary

This PR does not change the global authoritative ship-gate.mjs. It establishes a deterministic consumer and conditional workflow policy first, so false blocks and stale-evidence behavior can be validated before any later global hard-gate integration.

Verification

The repository PR CI will run the existing policy architecture validation and unit suite, including the new receipt tests.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}