Refuse CI admission without complete exact-head gate coverage

[gunbai-bot]

Summary

Model CI evidence coverage in gunbc.merge_admission as a closed state: absent, running, stopped, complete, or stale. Admission accepts only complete coverage for the current PR head and current required-roster identity, with a nonempty unambiguous required population, exactly one execution per required gate, and success for every required gate.

This closes the model defect behind the 2026-08-01 incident: one aggregate CheckConclusion could not represent the difference between no run, a dependency-stopped run with unexecuted witness batches, and a complete successful run. merge_lifecycle also selected receipts by PR number alone; it now selects the exact (PR number, head SHA) and the bounded lifecycle alphabet includes a same-PR/different-head auto-heal transition.

This PR deliberately does not claim end-to-end closure of the observed live fail-open. The external dashboard readout that reported an absent run as ok=true lives outside this repository. This PR establishes the repository authority and executable conformance semantics; that external consumer must still adopt them. Until then: never merge unless an executing run explicitly names the current PR head and reaches every required witness.

PR B (separate and strictly after this merges) will model heal as producing a new subject and dispatch exact-SHA revalidation. It is intentionally not bundled here.

Test plan

• target/release/claim_batch --source-root dag --source-root src/v2 --entry dag/test/claim/check_coverage_admission_witness_test.dag --functions ... — 12/12 PASS.
• target/release/claim_batch --source-root dag --source-root src/v2 --entry dag/test/claim/merge_lifecycle_interleaving_witness_test.dag --functions ... — 9/9 PASS, including all 1,296 length-4 event sequences.
• git diff --check — PASS.

[gunbai-bot]

Cross-PR semantic check against #7522 (requested after the overlap was discovered): this coverage path is independent of the legacy classify_merge_admission_verdict. classify_check_coverage_admission does not call it, and #7522 does not rewrite it in the current diff; the 33-line replacement after that function extracts WalkAttemptId / TestedSubject into gunbc.merge_admission_identity. The only admission helper this PR reuses is check_conclusion_admits_merge_admission_floor, which #7522 leaves unchanged. Therefore the hunks are textually separate and #7522 cannot silently change coverage classification through that legacy classifier. Whichever lands second should still re-run check_coverage_admission_witness_test because both edit the same authority file.