Add agent work publication and stateless reference runner

[krandder]

What changed

• adds the ownerless, storage-free AgentWorkIndex publication log
• defines canonical task, work-receipt, and payment-envelope documents
• binds each exact payment envelope digest to the existing typed TransferAction salt
• adds a dependency-free stateless reference agent that recomputes finalized state on every tick and signs only through an injected sender
• separates accepted, queued, executable, paid, shortfall, and expired states with exact log/view/call/balance evidence
• adds a 16-drill matrix across unit, fake-RPC, local Anvil, and canonical Sepolia-fork tiers
• upgrades economic deployment manifests to schema v4, pinning exact live runtime hashes for the vault, proposal gateway, arbitration, and treasury executor before trusting their views

Why

Lane 5 needs traceable agent work and self-proposed compensation without introducing a second governance, escrow, custody, or payout mechanism. Existing Lane 4 typed transfers remain the complete payment authority. The P1 runner demonstrates restart-safe, permissionless operation while keeping all key custody outside the agent core.

Safety boundary

• no new economic contract or economic bytecode change
• no owner, upgrade, pause, storage registry, token custody, or withdrawal surface in the publication index
• no bids, slashing, guaranteed bounty, escrow, or self-payment exception
• accepted does not mean executable or paid
• hostile document contents remain inert; exact on-chain bindings and caps determine actions
• the runner does not resolve futarchy and takes at most one simulated, cap-checked action per tick
• evidence explicitly makes no claim of live deployment, live payment, external demand, or guaranteed payment

Evidence

metadata/agent-work-p1-evidence.json records 17 passing executions for 16 numbered drills, with exact published bytes/digests, transaction and block hashes, runtime-code pins, attempt history, balance conservation, and clean-RPC replay. Its SHA-256 sidecar hashes the exact committed bytes.

Validation

• Forge: 207/207, including six 128,000-call invariant campaigns
• explicitly enabled canonical Sepolia fork: 5/5
• Python 3.9: 84/84
• Python 3.14: 84/84
• forge fmt --check: green
• forge build --sizes: green
• FLM operational build-info verifier: green
• economic and AgentWorkIndex isolated code-hash checks: green
• AgentWorkIndex runtime: 374 bytes