feat: add Codex automation and runtime evidence

[sdsrss]

Summary

• add versioned task/evidence schemas, validation routing, agentsmd verify,
  and bounded scorecard reporting
• add native mutation/validation event journaling and runtime/session dimensions
• add pinned/latest runtime canaries, distributed automation recipes, and
  constrained Codex PR review workflows
• publish the additive public contract as agentsmd 5.1.0

Verification

• npm run check (final run): passed, including 383 hook smoke cases,
  Phase 4 runtime/workflow tests, ShellCheck, and an unchanged live-home guard
• full real-model conformance twice: each 29 passed, the registered
  discipline-task-orphan failure, 0 infrastructure errors, thresholds met
• formal performance SLO: passed, 15 runs x 2 rounds, conclusive
• spec:check, drift 35/35, version cascade, full validation routing, staged
  secret scan, and npm pack --dry-run --json: passed

Release

• version: 5.1.0
• hosted pinned/latest runtime canary will run on merged main before tagging
• the v5.1.0 tag will trigger the provenance-enabled GitHub/npm release,
  registry verification, and marketplace E2E