feat(decision-capture): log the surviving silent suppression (bug 011 option 4)

[Kyarha]

additive observability only, fix class still the maintainer's — @ramboz to validate before merge.

Implements bug 011 option 4 (suppression logging), the piece #109 finding 2 left on the table. Follows #117, which decided the fix class and removed dropping on both recorded-corpus paths.

Why this exists after #117

#117 deliberately kept one drop: decision_scratch.dedup_scan_against_stubs. Its own residual 1 documents the consequence — a Tier-3 agent reversal of an in-flight stub is still silently dropped there, since agent prose never produces a stub of its own to survive as. On disk, that drop was indistinguishable from "nothing was found." Bug 011's record even overclaimed "no silent suppression remains to log" — this corrects that.

So the original A4 scope (dedup() / prune_recorded_stubs()) collapsed: #117 turned both into flags that surface, so there is nothing silent left to log there. The one surviving silent drop is the only thing worth instrumenting, and this PR instruments exactly it.

The change

dedup_scan_against_stubs	on each drop, appends one JSON line to .jig/decision-suppressions.log (dropped candidate quote/tier/who, covering stub, containment score, call site). The drop is unchanged — same rule, same result, logging is a gated side-effect.
decision_scan.containment()	new measure returning the raw score; is_contained is now a threshold over it, so the number that decides a drop and the number logged share one home.
logging contract	fail-open (a broken sink never changes what is suppressed) and opt-in via project_dir — pure-function callers log nothing and behave identically.
.gitignore	ignores the new log, matching the decision-scratch precedent (jig-local runtime state, per-checkout, never tracked).
bug 011 record + refinement-todo #255	overclaim corrected inline; ## Amendments note added; residual gains an observability line. Fix class stays deferred.
hosts/ (claude + codex)	regenerated.

Scope guardrails (out of scope, on purpose)

• Does not touch the drop. What surfaces and what is pruned is byte-for-byte unchanged.
• Does not decide the fix class. Whether dedup_scan_against_stubs should drop at all stays the maintainer's call — this removes the silence, not the residual. Bug 011 stays DONE; the residual stays a residual.

Test evidence (red → green, TDD)

Red — the drop happened, no log existed:

TypeError: dedup_scan_against_stubs() got an unexpected keyword argument 'project_dir'
AttributeError: module 'decision_scratch' has no attribute 'suppression_log_path'

Green after implementation:

• test_decision_scratch.SuppressionLogTests (4): a drop writes one inspectable line; a kept candidate logs nothing; logging is opt-in (no project_dir → no write, unchanged behaviour); a broken log sink never changes what is dropped (fail-open).
• test_jig_decision_capture.py (+2, end-to-end through the real Stop hook): the dedup drop writes a suppression line naming dedup_scan_against_stubs; a plain surfacing with no drop writes no log.
• Full decision suites green: test_decision_scan + test_decision_scratch (73), inflight hook (12), capture hook (13). Ruff clean. Validated on Python 3.9.6.

The one drift-guard flake on hosts/claude/.claude-plugin/plugin.json is the known, pre-existing intermittent one (docs/bugs/008) — that file is untouched here and clean in the tree.

[Kyarha]

Ran a multi-perspective self-review on this and pushed follow-up fixes. Summary for @ramboz before validating:

Outcome: no blockers, nothing on security/reliability — the change is genuinely additive and well-tested. Three polish items found and addressed in 6032dfd:

• Log the dropped candidate's turn — the owner's locator for the possibly-reversing statement the log exists to surface (previously only the covering stub's turn was recorded).
• Restore the closed-record prose — the Fix-class overclaim in bug 011 is now preserved verbatim and flagged with a footnote rather than rewritten, per ADR-0010 (records keep their original prose; the correction is annotated and carried in the amendment).
• Docstring note that .jig/decision-suppressions.log is append-only / unbounded by design (never read into context, clipped lines, git-ignored).
• Added unit coverage: the turn is logged, and the no-turn sentinel (-1) omits the key.

Deferred, with a note in refinement-todo.md (724842e): narrowing the log to agent-sourced drops to cut noise — only agent prose can hide a lost decision (user drops are recorded elsewhere), but I kept the fix purely additive with the simple "every drop is logged" contract for now. Revisit if the log proves noisy in practice, or fold into the flag-don't-drop mitigation.

Verification: decision suites green on Python 3.9 — test_decision_scratch (34), test_decision_scan (40), capture hook (13), inflight hook (12); ruff clean; claude + codex hosts regenerated and byte-identical to source. These follow-ups are additive polish on already-green tests, so there's no pre-fix red witness for them. Full CI hasn't run on 6032dfd / 724842e yet.

Still your call: the fix class — whether dedup_scan_against_stubs should drop at all — stays deferred exactly as this PR scopes it. This removes the silence, not the residual.

Separately: while reviewing I confirmed the new .jig/decision-suppressions.log is another instance of the pre-existing scaffolder gap in #107 (jig-local runtime state not reaching scaffolded projects' .gitignore) — added a note there. Unrelated to this PR.