feat(adaptive): add fail-closed candidate screening

[thinksyncs]

Summary

• Add non-executing candidate screening before adaptive selection.
• Keep unavailable or untrusted candidate evidence fail-closed.

Changes

• Add the CandidateScreeningRecord schema, bounded append-only projection, and path-derived trust.
• Map screening pass, hold, reject, absence, conflict, and revision mismatch into recommendation preflight.
• Add the empty packaged screening SSOT and synchronize manifests, docs, manual, report, generated references, and CI/package checks.

Testing

• bash scripts/pre_push.sh (185 focused tests, offline smoke, real-image preflight)
• .venv/bin/python -m unittest -v tests.test_candidate_artifact_ai_surface
• python3 tools/validate_tool_manifest.py --manifest tools/manifest.json --require-declarative
• python3 -m unittest tests.test_packaged_tools_manifest tests.test_manifest_docs_references

Notes

• The canonical screening stream remains empty. No candidate was downloaded, executed, qualified, registered, selected, or promoted.
• A workspace screening stream is always operator-asserted and cannot satisfy the repository-managed pass gate.