[Tristan-Stoltz-ERC]

Summary

Stacked on #2847. Adds the missing stateful execution-feedback contract: a submitted request's controller outcomes are validated and tracked until terminal state.

Changes

• Adds ControlOutcomeLedger in symtropy-robotics-bridge-core.
• Registers only submitted dispatch receipts with nonzero request/session/sequence and a nonempty controller ticket.
• Requires unique request IDs and unique controller tickets within one ledger.
• Binds each outcome to the previously registered request ID and exact controller ticket.
• Rejects unknown requests, ticket mismatches, malformed outcomes, non-advancing controller ticks, backward timestamps, illegal lifecycle transitions, and any outcome after a terminal state.
• Leaves the last accepted outcome unchanged on all rejected event paths.
• Does not evict request records or terminal tombstones automatically; capacity exhaustion fails closed.
• Fixes a transition gap discovered during review: an executing request can now be terminally vetoed by a safety authority. A regression test verifies the transition and post-terminal immutability.
• Adds a fixed-seed, 256-request adversarial corpus across six invalid-event classes; every rejection must preserve state, and each request must subsequently complete normally before post-terminal replay is tested.
• Adds tests for registration preconditions, ticket uniqueness, legal lifecycle progress, Executing → Vetoed, terminal replay, unknown IDs, ticket mismatch, duplicate ticks, backwards time, malformed veto events, capacity exhaustion, and immediate terminal failure.
• Rebased onto the current native-adapter head after an upstream formatting-only commit; branch ancestry is now linear and mergeable.
• Expands CI's pull-request base-branch allowlist for the stacked outcome-ledger, paired-benchmark, and scorer branches.

Claim ceiling

This is an in-memory conformance ledger, not a durable audit log, authenticated event transport, proof of physical execution, or cognitive learning loop. The real controller integration must forward its actual ticket and telemetry; production needs explicit restart-safe persistence/rekey semantics. Authored tests are not test-pass evidence.

Validation

• Current exact PR head: 3bb0641
• Exact-head CI run: https://github.com/Luminous-Dynamics/symtropy/actions/runs/40880715098 (queued, not passed).
• The earlier run 40865524285 was for older source head f1972cf and does not validate the current head.
• No local Rust compile/test was possible because this execution environment has no Cargo/Rust toolchain.

Related: #2828, #2836, #2838, #2847.