feat(advisory): harden one-shot and campaign workflows

[ictechgy]

Summary

• fail closed before task reads and preserve child outcomes in core routing diagnostics
• make one-shot review safer and clearer with early trivial skips, task-only privacy, whole-council deadlines, visible urgent findings, and distinct partial exit status
• harden managed campaigns with protected verifier zones, all-workflow doctor probes, verifier provenance, lane-before-stdin ordering, and infrastructure-aware gate populations
• make Skill status conflict-tolerant and add an automated previous-release Skill upgrade ledger gate

Validation

• PYTHONPATH=src python3 -m unittest discover -s tests — 1,573 passed, 35 skipped
• extracted sdist isolation — 1,566 passed, 80 skipped
• ruff check . and ruff format --check .
• mypy --strict src tests — 204 source files
• python3 -m compileall -q src tests
• git diff --check

Scrubbed GLM review packets were used for the design and implementation findings; a final regression packet is being run before merge.

[ictechgy]

@coderabbitai review