fix(manifest): attach ModelHarnessManifest on every mode's result

[ernestprovo23]

Summary

The auditable ModelHarnessManifest is documented as first-class on every CouncilResult ("rides on every result, not behind a debug flag"), but in practice only the ask/synthesize path built one. debate, adversarial, and vote constructed their result directly in modes.py and returned with manifest = None, so the invariant silently drifted for 3 of 5 modes and no test guarded it.

The fix — a single-site invariant

All five modes funnel through the one chokepoint Council._cached_run. This PR adds Council._ensure_manifest, called there on every returned result:

• No-op for the synthesize/raw path (it already builds a richer manifest in _ask_uncached, so it can populate verdict-provenance slots and re-stamp secret-safety).
• Fills the manifest for debate/adversarial/vote from the resolved membership + collected answers.
• Covers the zero-members early return and the cache-hit path, so no result can escape without a secret_safety = verified_no_secrets manifest.

Membership is re-resolved via the existing _available_members() (the same resolution _cache_key already performs) rather than threaded through every mode's return — so providers_called/model_ids reflect the full membership even for debate rounds where a member later dropped out, while per-answer receipts come from result.answers.

Verdict scope (deliberate)

Manifest everywhere; verdict scope unchanged. The clustering verdict still runs on synthesize/ask only. It is not forced onto adversarial (which already emits a judge verdict, so it would double-count the same adjudication) and is deferred on debate/vote. Rationale recorded in PDD §4a.

Tests

New tests/test_manifest_all_modes.py pins the invariant per mode: manifest is not None and secret_safety == verified_no_secrets for debate, adversarial, and vote, including the zero-members and cache-hit paths. Full suite: 499 passed, coverage 92.3% (gate 75%), ruff check + ruff format --check clean.

Doc reconciliation

• Manifest-on-every-result claim is now true — strengthened to state the one-chokepoint invariant across all five modes (README, SYSTEM_CONTEXT_DIAGRAM.md, PDD §4a).
• The constrained-choice vote mode is documented as shipped (CAC-09 / vote mode — structured majority with reported split #3), not "absorbed by provider_votes" — the two are complementary (a fixed ballot vs. clustered free-form stances). Updated across README, SYSTEM_CONTEXT_DIAGRAM.md, PDD (§1/§3/§4a/§8/§9/§12), DOCUMENTATION_INDEX.md, and CHANGELOG.md. All core docs remain under 500 lines.

🤖 Generated with Claude Code

https://claude.ai/code/session_01QofWZ4MivqEKPevjSYuwdk