Require causal diagnosis before repair

[Stunspot]

What changed

• Makes causal diagnosis a mandatory, proportional gate before repair after any unexpected verification result.
• Requires preserving the exact failure, locating the earliest divergence, maintaining a live differential, and running a discriminating check.
• Forces the causal model to reopen when a repair exposes a different failure instead of treating failures as a patch queue.
• Allows an irreducible “shit happens” conclusion only after reasonable alternatives are investigated and the remaining uncertainty is bounded.
• Adds causal custody to independent review.
• Carries the rule through canonical, plugin, and fileless fallback surfaces.
• Adds two behavioral evaluation cases for sequential validator repair and genuinely irreducible CI failure.

Why

TestForge previously told the operator to classify failures before patching, but it did not make “why did this happen?” the controlling first move. That allowed a plausible local workaround to substitute for diagnosis and a changed failure signature to become the next patch chore.

Validation

• GitHub connector readback exactly matched all 11 intended branch text files.
• The evaluation YAML parses after adding the two cases.
• The equivalent working-package delta passed TestForge package verification (123 files), 9 unit tests, the 12-case static eval validator, and both skill envelope validators.
• Fresh behavioral model episodes remain required before claiming behavioral transfer.

Release-custody boundary

• This draft does not revise the immutable settled release under releases/v1.1.3/, publish a new release, or choose a future version.
• Both historical v1.1.1 Claude archives were restored byte-for-byte to their main blob identities and are absent from this PR's diff.
• The current CI failure is a legacy oracle problem: test_host_packaging.py compares mutable top-level source-shaped trees to historical v1.1.1 archives. Regenerating those archives would violate the v1.1.3 maintainer rule to build a new empty versioned output and never mutate a previous release.
• The 11 edits presently live only in legacy top-level v1.1.1/v1.1.2 source-shaped lanes. They become a new public runtime release only after selected-source custody, a future version decision, a new-output build, and independent verification.
• A separate root rolling-manifest mismatch already exists on clean main after later Pages additions; it must be repaired or retired as infrastructure, not hidden by rebuilding historical release objects.