feat(bench): add sealed holdout corpus protocol

[Punisheroot]

Summary

Introduce an offline-complete, answer-free sealed holdout corpus protocol and evaluator boundary.

The public v4 corpus now commits to an immutable schedule, PowerPlan, focused-test policies, and sealed oracle bytes without exposing evaluator answers, filesystem locations, or executable test commands. Existing public holdout IDs are retained as explicitly synthetic, provider-ineligible fixtures.

Closes #6.

Implementation

• Add the needle.frozen-corpus/4 answer-free manifest format with explicit material classification and digest-bound evaluator policy references.
• Add immutable schedule and PowerPlan artifacts:
  • calibration uses exactly one repetition of FrontierDirect and NeedleMiss;
  • holdout schedules every FinalArm;
  • per-route repetition counts are taken from the bound PowerPlan.
• Add a bounded ArmLaunch projection containing only runner-safe task metadata and manifest, schedule, and PowerPlan digests.
• Add an evaluator-owned sealed bundle boundary with exact byte commitments, safe relative paths, bounded reads, and a structured direct Cargo focused-test policy.
• Extend corpus preflight to validate the manifest, schedule, PowerPlan, campaign, full protocol budget, source checkout, and optional sealed bundle independently.
• Keep provider execution fail-closed until an isolated executor consumes only ArmLaunch.
• Restrict v2/v3 manifests to explicit legacy offline replay paths; live/provider entry points reject both legacy manifests and the currently unsupported v4 execution path.
• Keep the v4 final gate fail-closed until issue Harden the paired-analysis, PowerPlan, and BCa final benchmark gate #7 integrates exact schedule-bound observations.
• Add complete synthetic sealed fixtures and adversarial validation coverage.

No dependencies or generated artifacts were added.

Validation

cargo fmt --all -- --check
passed

git diff --check
passed

cargo test --locked -p needle-bench --all-targets
48 tests passed across 9 suites

cargo test --locked -p needle-app
84 tests passed across 3 suites

cargo clippy --locked -p needle-bench --all-targets -- -D warnings
no issues found

cargo clippy --locked -p needle-app --all-targets -- -D warnings
no issues found

cargo run --locked -p needle-bench --bin corpus-preflight -- --workspace-root . --manifest benchmarks/corpus/router-cache/manifest.json --source-repository target/router-cache-source --output target/corpus-preflight/root-default.json
exited successfully; missing production bundle/source remained reported and provider readiness remained false

cargo run --locked -p needle-bench --bin corpus-preflight -- --workspace-root . --manifest benchmarks/corpus/router-cache/manifest.json --source-repository target/router-cache-source --sealed-bundle-index benchmarks/corpus/router-cache/synthetic-sealed/index.json --sealed-bundle-root benchmarks/corpus/router-cache/synthetic-sealed --output target/corpus-preflight/root-synthetic.json
exited successfully; manifest, schedule, PowerPlan, campaign, and synthetic bundle validated; full budget was 172157430 microcredits; provider_inputs_ready=false and provider_run_ready=false

No provider-backed run, production sealed bundle, production PowerPlan, or performance claim was executed or validated.

Risks/limitations

• All checked-in v4 tasks, holdouts, sealed documents, and PowerPlan observations are synthetic and cannot support provider or statistical claims.
• The protocol validates data boundaries but does not prove filesystem ACLs or process isolation. Production evaluator material must remain unmounted and inaccessible to the runner identity.
• Provider execution intentionally remains unavailable until a separate isolated executor or broker consumes only the bounded ArmLaunch projection.
• The v4 final gate intentionally rejects evaluation until issue Harden the paired-analysis, PowerPlan, and BCa final benchmark gate #7 supplies exact schedule-bound observation handling.
• Legacy v2/v3 fixtures remain available only through explicitly offline loaders; callers relying on legacy manifests for live execution will now fail closed.

Documentation/evidence

• Updated PROJECT_STATUS.md with the implemented protocol boundary and remaining release gates.
• Updated benchmarks/README.md and docs/BENCHMARKING.md with answer-free publication, evaluator isolation, synthetic-fixture, and provider-readiness constraints.
• Added the immutable schedule, synthetic PowerPlan, v2 campaign, legacy offline fixtures, and complete synthetic sealed evaluator bundle.
• Added publication-surface coverage ensuring the public manifest and launch projections do not expose evaluator paths, answer fields, or sealed test argv.

AI assistance and human verification

AI assistance: code only
Human verification: Reviewed the complete 26-file diff; traced the manifest, schedule, PowerPlan, ArmLaunch, preflight, evaluator-bundle, final-gate, and legacy-loader boundaries; checked all affected app call sites; inspected the public JSON surface for answer-bearing fields; verified exact artifact commitments and both preflight reports; and personally ran the reported formatting, test, and Clippy commands.

Ownership checklist

• I read and understand the complete diff and can explain every material change.
• I personally verified the reported tests and technical or performance claims.
• I finalized and personally published the commits and this pull request.
• I checked for unrelated edits, credentials, generated files, and live artifacts.
• Public documentation and PROJECT_STATUS.md are updated when applicable.