fix: enforce evidence-backed DP-5 escalation

[jack-lrx]

Summary

• add a guarded ssf debug path for recording failed fixes and confirming DP-5
• require three distinct, current, evidence-backed debugging attempts before escalation
• keep Wave Review repair failures separate from debugging attempts
• block generic ssf state set writes to protected dp_5_* fields
• mark legacy DP-5 state without a valid ledger as unsupported in audit output
• update workflow skills and documentation to use the guarded commands

Root cause

The generic state field allowlist included every dp_5_* field, while the bug-investigator instructions told agents to write DP-5 through ssf state set. Neither path checked debugging state, attempt count, evidence, the current execution plan, or explicit confirmation. Audit then treated any non-empty DP-5 result as recorded.

Implementation

The new debugging-attempt ledger is bound to the current artifact, contract, and execution-plan context. Evidence must be a physical file inside the change directory; duplicate, missing, changed, stale, or symlink-redirected evidence is rejected. ssf debug escalate ... --confirm is the only supported writer for DP-5 and requires at least three valid attempts.

Existing state files remain readable. A legacy unbacked DP-5 value is preserved but reported as unsupported, so compatibility does not silently convert it into a valid approval.

Verification

• npm run build
• NPM_CONFIG_CACHE=/private/tmp/spec-superflow-npm-cache npm test — 667 passed
• npm run check-versions
• npm run validate
• node scripts/spec-superflow.mjs doctor
• changed Skill validation for bug-investigator and build-executor
• git diff --check

Fixes #102