Delegation detail-fidelity + PM-loop hardening (#541)

* feat(gateway): delegation detail-fidelity — details survive hand-off, both directions

Details thinned out at every delegation hop: a PM child task mapped to no
parent criterion was legal (coverage only surfaced at submit_up, after the
whole wave ran — a 12-subtask docs tree grew through 8 review rounds that
way, one child titled 'docs page and route wrapper' shipping only the
page), and QA could pass work on a gestalt read (a 4-scene video brief
shipped 3 scenes past every gate because the features existed only in
prose). Three chokepoint gates:

- delegate (down): every child must declare covers_parent_criteria
  resolving against the parent's real acceptance criteria — no mapping or
  an unresolvable ref rejects naming every offending child and the valid
  criteria; the success envelope carries parent_ac_coverage
  {covered, uncovered} so a wave-planning PM sees remaining gaps in the
  same turn. Full coverage stays enforced at submit_up (waves stay legal).
- pass_review (up): mandatory criteria_verified — one {criterion,
  evidence} entry per task AC, matched by the findings ledger's
  id-or-exact-text matcher, evidence soup-checked and capped; rejects
  naming the unverified criteria; entries render deterministically into
  qa_notes as '[AC] <criterion> — verified: <evidence>' lines. The old
  count-only ac_verdicts gate is superseded (arg kept for back-compat).
- video briefs (structured detail at origination): an enumerable feature
  list (release highlights, or input_props.highlights carried onto a
  reject re-author) becomes its own scene acceptance criterion, bounded to
  the AC caps; a re-author without highlights carries the
  feedback-addressed criterion instead.

Extracted findings.py's criterion matcher into shared unmatched_criteria /
uncovered_acceptance_criteria instead of duplicating it; criteria_verified
joins the WAF free-text exclusion set like findings/issues.

* fix(gateway): break the block/unblock wedge — four hardening fixes from the live PM loop

A cell task looped fe-pm/main-pm block/unblock for hours (10 cycles, 43
spawns): a transient GitHub API error resolving CI became an unwaivable
blocker finding whose own fix text said no code change was required, the
submit freshness guard then demanded a commit no finding called for,
escalate_up auto-blocked, and main-pm's correct recovery plan 422'd on
the approach length cap, degrading it to a bare unblock. Four fixes:

- pr_pass CI-unresolvable refusal is now explicitly transient-worded:
  retry pr_pass shortly, do NOT pr_fail over a CI-status lookup error —
  a platform blip is not a code finding
- submit freshness guard grants ONE unchanged-head resubmission per
  head sha when the findings ledger has zero open rows (all addressed
  without code changes) — stamped via the resubmit_unchanged_head
  marker so the same head can never loop a second time
- unblock carries a flip breaker: block_flip_count marker, and at the
  third flip a one-shot CEO notification flags the task as structurally
  wedged (unblock itself still succeeds — the breaker signals, it does
  not wedge recovery)
- i_will_plan's approach cap truncates at 800 chars instead of
  rejecting — an over-detailed plan must never cost the PM its turn

---------

Co-authored-by: Renn F <rennf93@users.noreply.github.com>

tests/unit/foundation/policy/content/test_markers.py

@@ -6,6 +6,9 @@ from types import SimpleNamespace
 
 from roboco.foundation.policy.content import markers as m
 
+# Named constant — ruff PLR2004 forbids magic-value comparisons.
+_TWO = 2
+
 
 def _task(om: dict | None = None) -> SimpleNamespace:
     return SimpleNamespace(orchestration_markers=om)
@@ -130,3 +133,25 @@ def test_docs_sync_release_version_roundtrip() -> None:
     assert m.get_docs_sync_release_version(t) is None
     m.set_docs_sync_release_version(t, "0.23.0")
     assert m.get_docs_sync_release_version(t) == "0.23.0"
+
+
+def test_resubmit_unchanged_head_roundtrip() -> None:
+    t = _task()
+    assert m.get_resubmit_unchanged_head(t) is None
+    m.set_resubmit_unchanged_head(t, "aaaa1111bbbb2222")
+    assert m.get_resubmit_unchanged_head(t) == "aaaa1111bbbb2222"
+
+
+def test_block_flip_count_bump_and_notify() -> None:
+    t = _task()
+    assert m.get_block_flip_count(t) == 0
+    assert m.is_block_flip_notified(t) is False
+    assert m.bump_block_flip_count(t) == 1
+    assert m.bump_block_flip_count(t) == _TWO
+    assert m.get_block_flip_count(t) == _TWO
+    # notified stays False across bumps until explicitly marked.
+    assert m.is_block_flip_notified(t) is False
+    m.mark_block_flip_notified(t)
+    assert m.is_block_flip_notified(t) is True
+    # Marking notified must not reset the counter.
+    assert m.get_block_flip_count(t) == _TWO