vulnerability patching

The exploit stopping and the bug being gone are two different facts, and the usual check only measures the first. Here is a runnable patch that passes the PoC and the tests while still leaking a neighbor's data, and the three checks that catch it.

Fourteen hundred findings are not fourteen hundred patches. The design that ships separates triage from fixing, version bumps from source patches, and gives merge rights to evidence classes rather than to the agent. Includes the merge policy as runnable code.