Harden behavior guard attribution and admission

[wang-tong0]

Summary

• Treat positive-score samples with zero calls, commands, tokens, and output as durable non-scoring invalid samples; never turn them into model strikes.
• Separate sample integrity, template health, and model behavior circuit breakers. Template quarantine requires cross-subject/task reproduction, while model failure requires structured attribution across distinct template families.
• Add bounded deployment-scoped behavior preflight with absolute admission deadlines, endpoint load attribution, reserved request capacity, and explicit shadow/admission-shadow/enforce semantics.
• Prevent liveness loops by tombstoning typed deadlines, generic harness exceptions, and unattributed result errors, and by extending task pools when invalid samples make overlap impossible.
• Add durable admission deferral/cooldown/exhaustion handling and atomic expiry/promotion fencing.

Root cause

The previous guard mixed sample-integrity anomalies with model behavior, relied on weak or textual failure signals, and could repeatedly dispatch invalid or inconclusive work. It also lacked a deployment-wide admission deadline and safe endpoint-load attribution, which made both false positives and hour-long retry loops possible.

Impact

• Garbage/no-progress models can be stopped during bounded preflight before expensive SWE/Terminal fan-out when evidence is attributable.
• Harness, template, and infrastructure failures do not count as model violations.
• Plain shadow remains non-blocking; admission-shadow holds only until its absolute deadline; enforce blocks only on durable policy state.
• No additional GPU is required: 4 of each endpoint's 600 request slots are reserved for preflight and benchmark traffic is capped at 596.

Validation

• pytest -q: 847 passed
• Targeted ruff check: passed
• python -m compileall: passed
• git diff --check: passed