feat: add contribution lifecycle salvage gate

[VrtxOmega]

Summary

• add an offline, deterministic lifecycle assessment for contributions whose patches may have drifted, been superseded, or retained salvageable value
• decompose mixed contributions into atomic claim units, classify each unit across seven controlled states, and emit bounded next actions plus salvage packets
• expose JSON, Markdown, and plain-text output through pcf lifecycle
• add a fixture corpus and focused tests, including a retrospective Hermes Agent case with observation-time evidence separated from the later outcome

Why

A closed, stale, or no-longer-cherry-pickable PR is not enough information to decide whether the underlying engineering was invalid. PCF needs a fail-closed way to distinguish current patches, rebaseable drift, durable invariants, partial supersession, equivalent supersession, invalidation, and cases that require a maintainer decision.

Safety and evidence boundary

• no network calls or GitHub writes are available from the lifecycle command
• contradictory, incomplete, or unsupported evidence fails closed
• later outcomes and attribution are recorded separately and do not affect the observation-time classification or assessment SHA-256
• the retrospective fixture is evidence of one case, not a claim of universal accuracy or maintainer endorsement of PCF

Validation

• npm run ci:gates — repository/CI contract checks, syntax checks, 274/274 tests, 77/77 benchmark cases, 29/29 adversarial cases, and maintainer demo passed
• npm run mcp:smoke — health, server card, readiness, repro gate, and no-public-write-tool assertions passed
• git diff HEAD^ HEAD --check — passed
• removing the Hermes later-outcome block preserves the same classification and assessment hash

Diff shape

Six files are intentionally in scope: lifecycle engine, CLI wiring, fixture corpus, focused tests, README documentation, and explicit syntax-check registration. No dependency or generated-file churn is included.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ce880a07d9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Enforce ISO-8601 timestamps before parsing

Date.parse accepts non-ISO strings despite the error message and lifecycle contract requiring ISO-8601; for example, on the supported Node runtime, "0" is accepted and normalized to 2000-01-01T00:00:00.000Z, and "July 19, 2026" is also accepted. A malformed observedAt, checkedAt, or outcome timestamp can therefore silently alter the chronology checks and assessment fingerprint rather than failing closed. Validate the original string against the supported ISO-8601 form before calling Date.parse.

Useful? React with 👍 / 👎.