Refine prospective GHCP evaluation recovery, applicability and ambiguity case

[George Ng (GeorgeNgMsft)]

This follow-up above #3072 adds bounded safe-read recovery, frozen-run checks and scoped file-handler consent, integrated with the protocol-5 common-file corpus and Luna-pinned evaluation package. It preserves seven candidate semantics and four five-case cohorts without rewriting historical measurements. The independent result-handoff fixes in #3073 are not a dependency.

• Integrate parent f2f045c20 through a normal merge, preserving bot history. common-files-v1 replaces nine list-dependent cases with common-capability file tasks: all 20 cases apply to every candidate, yielding 140 executions per full repetition. This supersedes protocol 4's 131 executions plus nine native N/A slots, not historical scores.
• Derive counts from the frozen schedule and reject changed protocols, corpus versions or orders. Require fresh corpus-marked preflight evidence; preserve file snapshots, byte-exact backups, unrelated-state checks and failed-trial evidence.
• Retain narrow per-case permissions, clarification gates and M3's original-backup prerequisite. No arbitrary shell-write approvals or measured list mutations. Preserve historical A4's original prompt, failure and replacement rationale without claiming general product ambiguity is solved.
• Recover only from affirmative read-I/O evidence plus a complete read-only backend trace for TypeAgent. Write/copy failures, denials, cancellations, uncertainty, missing details and conflicting error fields remain terminal. No retry loop or expanded artifact access.
• Handle the file handler's second Run/Cancel consent after dispatcher confirmation. Require the exact prompt/choices, unambiguous current-tool admitted action and independent case oracle. Bind structured consent to scope/operation/interaction, consume once, invalidate on unrelated/terminal work, and compare response fields independent of JSON key order. Consent never supplies an ambiguous referent.
• Preserve the sibling evaluation package, short plugin README link, initial-ballpark/environment-isolation caveats, Luna pin, early ledger admission and ledger-derived limits.

Validation: dependency-inclusive build and 137 dispatcher tests passed during integration. Final consent corrections pass 34 evaluation tests, package syntax build, pinned formatting and all four committed-head ratchets against 79fad5b4f: lint 0→0, cyclomatic/cognitive over-budget counts 0→0, circular dependencies 220→220 with 11 existing exceptions, test debt 0→0. Fresh preflight completed actual inventory/read/copy/append and read-only GitHub/network operations. Structured S4 pilot verified both consent stages and exact state preservation. Other pilot denials remain failures; pilot evidence is separate from measured outcomes. Hosted CI for the latest head is not yet claimed complete.

Fresh live round — paused after 21/140 trial records: the user separately authorized 40,000 additional Copilot AI credits. Execution is frozen at 96e904546acc389cf64284db9b6fbcbe57191344. Three complete seven-candidate batches ran for M5, M1 and M4; 119 trials remain unstarted. The runner paused before batch four because a timed-out M4/C3 request lacks billing settlement. Its full 250-credit reservation remains held; no automatic retry or trial replay occurred. This is a reconciliation pause, not budget exhaustion. Partial evidence and accounting snapshots are preserved privately. Independent faithfulness/accuracy review is outstanding; no new accuracy or latency conclusion is claimed.

Historical ledgers remain closed and the protocol-2 run at e847c7a009 remains unchanged. Private network payloads, artifact paths and billing traces are not published. Stack #3080 remains #3072 followed by this PR; no stack metadata changes.