Delegation detail-fidelity + PM-loop hardening (#541)

* feat(gateway): delegation detail-fidelity — details survive hand-off, both directions

Details thinned out at every delegation hop: a PM child task mapped to no
parent criterion was legal (coverage only surfaced at submit_up, after the
whole wave ran — a 12-subtask docs tree grew through 8 review rounds that
way, one child titled 'docs page and route wrapper' shipping only the
page), and QA could pass work on a gestalt read (a 4-scene video brief
shipped 3 scenes past every gate because the features existed only in
prose). Three chokepoint gates:

- delegate (down): every child must declare covers_parent_criteria
  resolving against the parent's real acceptance criteria — no mapping or
  an unresolvable ref rejects naming every offending child and the valid
  criteria; the success envelope carries parent_ac_coverage
  {covered, uncovered} so a wave-planning PM sees remaining gaps in the
  same turn. Full coverage stays enforced at submit_up (waves stay legal).
- pass_review (up): mandatory criteria_verified — one {criterion,
  evidence} entry per task AC, matched by the findings ledger's
  id-or-exact-text matcher, evidence soup-checked and capped; rejects
  naming the unverified criteria; entries render deterministically into
  qa_notes as '[AC] <criterion> — verified: <evidence>' lines. The old
  count-only ac_verdicts gate is superseded (arg kept for back-compat).
- video briefs (structured detail at origination): an enumerable feature
  list (release highlights, or input_props.highlights carried onto a
  reject re-author) becomes its own scene acceptance criterion, bounded to
  the AC caps; a re-author without highlights carries the
  feedback-addressed criterion instead.

Extracted findings.py's criterion matcher into shared unmatched_criteria /
uncovered_acceptance_criteria instead of duplicating it; criteria_verified
joins the WAF free-text exclusion set like findings/issues.

* fix(gateway): break the block/unblock wedge — four hardening fixes from the live PM loop

A cell task looped fe-pm/main-pm block/unblock for hours (10 cycles, 43
spawns): a transient GitHub API error resolving CI became an unwaivable
blocker finding whose own fix text said no code change was required, the
submit freshness guard then demanded a commit no finding called for,
escalate_up auto-blocked, and main-pm's correct recovery plan 422'd on
the approach length cap, degrading it to a bare unblock. Four fixes:

- pr_pass CI-unresolvable refusal is now explicitly transient-worded:
  retry pr_pass shortly, do NOT pr_fail over a CI-status lookup error —
  a platform blip is not a code finding
- submit freshness guard grants ONE unchanged-head resubmission per
  head sha when the findings ledger has zero open rows (all addressed
  without code changes) — stamped via the resubmit_unchanged_head
  marker so the same head can never loop a second time
- unblock carries a flip breaker: block_flip_count marker, and at the
  third flip a one-shot CEO notification flags the task as structurally
  wedged (unblock itself still succeeds — the breaker signals, it does
  not wedge recovery)
- i_will_plan's approach cap truncates at 800 chars instead of
  rejecting — an over-detailed plan must never cost the PM its turn

---------

Co-authored-by: Renn F <rennf93@users.noreply.github.com>

tests/unit/gateway/test_submit_up_unchanged_pr_guard.py

@@ -80,9 +80,15 @@ def _resubmit_cell(
 
 @pytest.mark.asyncio
 async def test_submit_up_refuses_unchanged_pr_after_pr_fail() -> None:
-    """The loop-stopper: prior pr_fail stamped head SHA X, the cell PR head is
-    still X (no new dev work on the cell branch) → refuse, do not re-open the
-    gate."""
+    """The loop-stopper still holds past the one-shot exemption: prior
+    pr_fail stamped head SHA X, the cell PR head is still X (no new dev work
+    on the cell branch). The findings ledger here fail-opens to "nothing
+    open" (mock session, no real query) — the same signal
+    ``_check_submit_up_gates`` upstream already reads for FINDINGS_ADDRESSED
+    — so the first resubmit at this head is the one-shot exemption (see
+    test_resubmit_unchanged_head_exemption.py for full exemption coverage);
+    a second resubmit at the SAME head refuses, so the loop still can't run
+    forever."""
     c, cell_pm_id, cell_task_id = _resubmit_cell(
         notes_structured={
             "pr_review": {"verdict": "failed", "head_sha": SHA_OLD, "summary": "..."}
@@ -90,17 +96,23 @@ async def test_submit_up_refuses_unchanged_pr_after_pr_fail() -> None:
     )
     c.git.get_pr_head_sha = AsyncMock(return_value=SHA_OLD)
 
-    env = await c.submit_up(
+    first = await c.submit_up(
         cell_pm_id, cell_task_id, notes="re-submitting the cell after the fix"
     )
+    assert first.error is None, first.as_dict()
+
+    env = await c.submit_up(
+        cell_pm_id, cell_task_id, notes="re-submitting again; still unchanged"
+    )
 
     assert env.error is not None, env.as_dict()
     assert env.error == "invalid_state", env.as_dict()
     assert "unchanged" in (env.message or "").lower()
     remediate = env.remediate or ""
     assert "submit_up" in remediate
-    # The cell PR was NOT re-opened / re-pushed — the runner never ran.
-    c.task.submit_for_review.assert_not_awaited()
+    # The second attempt's PR was NOT re-opened / re-pushed — the runner ran
+    # only for the first (exempted) call.
+    c.task.submit_for_review.assert_awaited_once()
 
 
 @pytest.mark.asyncio