Spec A: guard off-menu governance decisions

[AMBRA7592]

Summary

• reject decisions outside a fork record’s soft-label options unless --allow-other is explicit
• mark deliberate exceptions with decision_off_menu so the audit trail distinguishes them
• preserve that marker when soft_labels.py regenerates the governance queue
• test on-menu behavior, non-mutating rejection, explicit off-menu round-trip, persistence, and default invariance

Scope

Three files: govern.py, test_claims.py, and one required guarded persistence line in soft_labels.py. The third file is necessary because the current merge block otherwise drops unknown governance fields on rerun.

Verification

• default triage.json, soft_labels.jsonl, soft_labels.csv, and governance.jsonl are byte-identical to main at 2c7f95f
• resolution records are identical after removing the expected runtime timestamp; replay hashes match exactly
• genuinely jsonschema-free venv: 27 tests, 25 pass + 2 intended skips
• jsonschema-enabled: 27/27 pass
• focused GovernanceClaims: 4/4 pass
• working tree clean

Audit note

This PR is intentionally left unmerged for independent release-gate review.