feat(ci): deterministic Odoo fixture + full verified/contradicted cov… - #753

Reviewed and refreshed — main merged in at 619ab089 (the branch was based on 825dc714, two merges behind, so its green was against a base that no longer exists).

Verified on the new head

• goldenRunner.test.ts + goldenModel.test.ts — 42/42
• full middleware suite — 6880 tests, 0 fail, 0 cancelled

The check I care about most passed

expected.via is a newly declared field, and the recurring defect in this repo is a field that nothing reads — it compiles, the tests pass, and the assertion is decorative. Not the case here: viaSatisfied is called at both decision sites, and the tests carry real negative cases (viaPass === false for the judge path, plus throws on an unknown expected.via).

Mutation-checked to be sure — forcing viaSatisfied to return true turns 2 tests red, and reverting returns 33/33. The path assertion is load-bearing, not decorative.

Cost, since this corpus is the one that just started actually running

I costed these evals recently, and got it wrong the first time by reading corpus size as call count. For anyone doing the same arithmetic here: the two new files are 2 entries, not 70 — the rest of those line counts is (excellent) commentary.

The one thing worth naming explicitly, because "no new env-var" in the description is true but is not the whole cost story: folding via into the resample guard means an entry with the right class but the wrong path now resamples, where before it would have stopped after one call. runEntry's own docstring already reasons this through correctly — green-on-first-sample costs one call, worst case stays bounded at maxRuns × corpus size — and the flake-tolerance argument for including via is sound. Flagging it only so the trade is visible in the PR, not just in the source.

No interaction with #748 (the temperature fix): the golden/verifier path sends no temperature, and DEFAULT_MODEL is claude-haiku-4-5, which accepts it regardless. Checked rather than assumed.

One nit

The description says the blast radius is test/golden/** + golden-eval.yml, but golden-eval.yml is not in the diff — the workflow is untouched. Worth correcting so a reader does not go looking for a CI change that is not there.

No blockers from me.