- defineRule gains publicEvidence + summarize (rule-owned, versioned); each of
the 9 rules publishes observed values, gates configured thresholds
- worker projects at persist time into run_steps.public_evidence + summary
(migration 0001); toPublicRunView serves the stored projection (dumb, zero
rule knowledge in web); session view unchanged via toFullRunView
- chose core+worker over contracts to keep ONE home for rule knowledge (no
drift, contracts stays zod-only)
- leak invariant over the whole registry: no configSchema key in any public
evidence; historical runs degrade honestly (null)
- replay corpus unchanged 13/2 (projections are presentation, not verdicts)
