reflect: prove pipelines by their real output, not a substitute

[EdbertChan]

Summary

Four fixes on the night of Sep 8 each passed a cheap proof and then failed one layer down when the real path ran. Every fix was correct. None of them made the feature work.

The cheap proofs were a unit test, a config read-back, four static workflow assertions, and a dry run. Each stands in for the real path, and each defect lived exactly at the seam the stand-in skips.

This adds three evidence rules to the always-loaded corpus.

The four instances

Fix	Cheap proof that passed	What the real path did
Repair-plan header (Invoker #12007)	unit test	died at dispatch on an agent/model mismatch
Fleet model switch	config read-back	killed the owner at boot on a third key that overrides the edited one
Nightly release (Invoker #12023)	four static workflow assertions	GitHub Actions is not permitted to create or approve pull requests
Session miner (Invoker #12027)	dry run reporting filed 2	submit failed, filed 0

Rules added

1. A pipeline or worker change is proven only by one uninterrupted real run at production settings that emits the pipeline's real output: a workflow id, a PR number, a tag, a merged commit.
2. A dry run proves the decision, never the effect. Never accept one as proof of a write path.
3. When a fix changes which identity, binary, or database a process uses, verify what the service resolves, not what your shell resolves.

Test plan

• corpus/CLAUDE.learned.md renders and the rules sit under the existing Evidence heading
• Backtest on the next pipeline change: its acceptance line should be a real output id

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_35c2c5d7-b39f-4a84-a0a7-7602380ffa37)