Add QA evidence bundles, detailed reports, and cleanup

[Hector-Ha]

What to build

Add QA Evidence Bundle and detailed session-specific reporting for Chrome-supervised QA sessions. Each run should preserve enough value-safe context for the maintainer to review results and decide whether to create GitHub issues or start TDD work.

This slice should make failures useful: screenshots, logs, redacted diffs, reproduction notes, grouped findings, and a detailed run report that is never overwritten by later sessions.

Acceptance criteria

• Each QA run creates an isolated evidence folder with a unique run id and timestamp.
• Each session writes a detailed report named like qa-report--.md instead of overwriting a shared report.
• Report includes run id, time, app commit/branch/dirty status, scenario list, per-scenario pass/fail/blocked, evidence paths, grouped findings, likely product bugs, setup/scenario problems, manual checks still needed, and recommended next issues.
• The agent can record final QA verdicts and TDD-ready failure notes: repro, expected vs actual, likely cause, relevant logs/evidence, and likely product area.
• Automatic start/end/error screenshots are captured for each scenario, with support for agent-added screenshots on surprising UI states.
• Evidence includes frontend console errors, backend/action logs, redacted env/file diffs, changed file paths, and run workspace paths when safe.
• Evidence is value-safe: no raw secrets, no full source dumps by default, and no sensitive credential values in screenshots or logs.
• GitHub issues are not auto-created for every failure; the report groups related failures so maintainer can decide.
• Tests cover report naming, no-overwrite behavior, redaction, and grouped failure output.

Blocked by

• Add CLI Chrome-supervised QA runner foundation #30
• Add PRD-style QA scenario slices and AltShift starter scenarios #31

[Hector-Ha]

Closing as not planned, not resolved.

This issue was created before the QA design finished. The design changed: QA harness/scenarios/evidence should live in private/local .qa-local or a private QA repo, while public InstantRepo should only add production-safe CLI surfaces. This issue mentions public QA runner/internal QA implementation and should not be picked up.

We will create replacement issues after the grill-with-docs design session is complete.