Simplify the 0.1.2 approval gate

[raghubetina]

Summary

• replace the evaluator-heavy release qualification with one human-observed two-turn smoke
• retain exact Plan read-back, explicit approval, unchanged SHA, zero/one Compile counts, and terminal outcomes
• remove shell grammar, generic environmental inactivity, and exhaustive tool/effect ledger requirements

Verification

• npm run check (70/70)
• exact package check against released CLI 0.1.0
• Skill quick validation
• deterministic package SHA-256 901d5baaebea0244a40b620d039acd4a8efbe8d657a142439c6fe3908a1465f8
• conversation-aware documentation review: PASS
• git diff --check

[raghubetina]

Post-merge review, hosted CI green (70/70 plus the exact package check). This PR is the pivot in the
approval-gate arc: it deletes most of what #39 added four days earlier (the exhaustive tool/effect ledger,
shell-command classification, workspace snapshots, proofs of generic no-network and no-write inactivity) and
replaces the evaluator-run two-phase qualification with a human-observed two-turn smoke.

The replacement keeps exactly the invariants that are observable and load-bearing: unchanged Plan bytes by
SHA-256, a complete semantic read-back before approval, Compile wrapper count zero before and exactly one
after, and validated terminal outcomes. What it drops are the negative proofs, which were expensive to produce
and weak as evidence (an agent attesting it did nothing else is not stronger than an observer watching two
turns). The candidate digest churn in the diff (ef59d4 back to 901d5b) is consistent with the byte-revision
rule for unpublished candidates.

Succession note: #41 later relaxed this further (controlled setup failures may be corrected and the smoke
rerun within the approved scope; one approval may cover a named release sequence). Read this PR's "stop on any
failure" language through #41's amendments.

[raghubetina]

This PR is about designing an approval gate for an AI agent, and the design principle it lands on is worth
keeping: gate on what an observer can verify, not on what the agent can attest.

The gate protects one moment: the instant before Compile runs against a Plan, which can end in creating a
real GitHub repository. The team wants a human to approve the semantic model of the Plan first. The question
is what evidence proves the approval flow worked.

The earlier version answered with attestation: the agent had to account for every tool it touched, classify
shell commands, snapshot the workspace, and demonstrate it made no network calls. The problem with proving
negatives is that the list of things-not-done is unbounded, the proof is produced by the thing being audited,
and every additional requirement adds a way for a healthy run to fail on paperwork. The failure evidence from
the previous qualification attempt shows exactly that dynamic.

The new version answers with observable invariants. A human watches two turns. Turn one: the agent presents
the Plan's semantic model and stops; the observer checks the Compile counter reads zero. Turn two: the human
approves the model and the exact Plan SHA-256; the agent compiles once; the observer checks the counter reads
one. Byte hashes pin that nothing changed in between. Each check is binary, cheap, and verified from outside
the agent.

The pattern generalizes: a counter at zero then one beats a promise of "nothing else happened," a content hash
beats "I did not modify it," and a stop-for-approval turn boundary beats an internal claim of having asked. If
you ever wire an agent to something irreversible, spend your rigor on external observability, not on the
agent's self-report.