Add provider-neutral Wiki shadow rebuild

[dkstm95]

Summary

• Add a provider-neutral, digest-bound shadow rebuild flow for existing source and concept pages.
• Add manual task, compare, and review CLI commands without an apply path.
• Compare accepted claims, sources, Wiki links, and lint results in a temporary Wiki copy.
• Preserve target metadata and reject stale, malformed, or structurally injected artifacts.
• Stabilize GitHub Verify Node permissions and add built CLI smoke coverage.

Why

The Wiki could prepare and review reusable answers, but it had no safe way to test whether existing
pages could be reconstructed from managed evidence. This adds a non-mutating experiment before any
promotion workflow is considered.

The previous Verify run also rejected the GitHub-hosted Node executable because it did not satisfy
the subscription runner's local executable permission policy. CI now copies Node to a private
runner-owned path without weakening the production security check.

Impact

The task and result formats do not depend on an API, provider, subscription product, or transport.
Users can pass the task prompt to any AI platform and compare the returned JSON locally. Shadow
rebuild cannot modify live pages, index.md, or log.md.

The Karpathy source and concept pages were exercised through the new flow. The final candidate had
no introduced lint issues, missing sources, or missing Wiki links, while the live Wiki remained
byte-for-byte unchanged.

Validation

• pnpm check
• 228 tests passed
• Branch coverage: 90.38%
• Built CLI smoke check passed
• Documentation check passed