feat(breg): add verified Evidence capabilities to governed Rhai actions

[jeremi]

Summary

Implementers can define a governed registry operation that computes values, refuses invalid input, conditionally verifies another registry through Evidence, and commits the resulting local records atomically. The farmer/landholding example trims and joins an identifier, checks active status, optionally obtains category, and persists the same identifier used in the verified request.

• Build on the governed Rhai actions and PostgreSQL integrity capabilities already merged in feat(breg): add governed registry operations and native integrity #923.
• Add the trial v2 evidence::resolve(capability, subjects) helper with reviewed offline contract imports, fixed operator trust, typed selected outputs and exact local transcript fixtures.
• Release PostgreSQL connections before external work; bound and cancel evaluation; reuse frozen results and identities for SQL retries; recover existing receipts before returning competing failures.
• Retain verified assertion material atomically with the application under restricted internal privileges, with explicit expired-evidence erasure tooling.
• Include complete authoring examples, generated schemas and CLI references, and the actual Evidence/PostgreSQL integration in the existing BREG CI lane.

Checks

• BREG compiler/helper and affected PostgreSQL action, reviewed-change, migration, receipt, history and startup regressions passed on PostgreSQL 18. After integrating feat(breg): add governed registry operations and native integrity #923, all 13 focused Evidence, retention, action-handler and membership PostgreSQL tests passed.
• BREG CLI: 392 tests passed, including exact action expectations and safe diagnostics.
• Actual Evidence provider fixtures: 18 cases passed. Native combined journey passed contract import, schema-test, external signing, package activation, HTTP registration/GET, refusals, denied direct creation and replay without another Evidence request.
• All-target BREG/bregctl Clippy with warnings denied, formatting, generated-contract comparisons, client contract checks, CI classifier/runner tests, and documentation build/accessibility/link checks passed locally.
• Existing opt-in issuer, benchmark and container-development tests were not run; the unrelated spatial fixture was excluded. CI results will be tracked on this PR.

Notes

Security review covered capability and selector authority, verification, cancellation, final authorization/freshness, receipt precedence, atomic retention and safe errors. The helper performs no arbitrary HTTP or database reads. Runtime retention access is INSERT-only; expired material requires explicit privileged maintenance.

This remains a trial ABI: at most two declared one-use capabilities, eight concurrent evaluations, bounded responses and retention, fixed trust, and request-origin selectors. Separate calls are separate observations. Reviewed-change Evidence integration and SDK action invocation are outside this change. Native PostgreSQL constraints continue to protect local stored invariants across write interfaces.

DCO

• Every commit includes a Signed-off-by trailer.
• I reviewed the submitted changes and am responsible for the contribution.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-08T10:58:52.483432Z	1e934b7	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e7777b829c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[jeremi]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9a4e854e41

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[jeremi]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5a45dfcaef

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[jeremi]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 👍

Reviewed commit: 1e934b757f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".