Add conservative whole-domain verification tiers

[david-hoffman]

Add the six approved verification tiers, complete-domain commands and sealed PR planning described in the task contract. Library, doctor and release commands run their entire owned domains and shared test closure with exact coverage. Shared or uncertain changes select canonical full verification. The syntax whitelist is deliberately narrow: unsupported bodies, imports or initialization select full. Explicit scoped commands cannot override PR planning or release preparation.

Canonical full and CI collection now clean-install their own exact wheel and source archive before testing. Receipts bind scope and disclose omitted sources. CI plans from the actual base, runs fresh checks on Linux/macOS/Windows, validates each platform separately and fails ci-required closed. Release preparation validates the current canonical receipt format while preserving legacy receipt compatibility and the existing source, destination and publication approval controls.

Frozen candidate: 3da5ee41600c61033bf438e538d449b93c3635ab, against a835a490373835fa01e4460ce2159365150d1946. All thirteen planned local runs passed on unchanged sources:

Command	Task caches cleared (s)	Warm 1 (s)	Warm 2 (s)	Tests per run	Owned sources
fast	9.0	1.9	1.9	quality only	no coverage claim
library	95.6	70.5	69.7	1,109	10
doctor	120.6	93.5	94.9	1,211	11
release	966.4	929.8	901.0	1,549	14
full	1,542.6	—	—	1,941	21

Every runtime run passed exact 100% statement and branch coverage across its complete declared scope. Full measured 3,421/3,421 statements and 902/902 branches globally and per package, with zero missing or excluded counts. Full receipt: 90df650c148084e555f492de2d281f9594eccbd84f55ec6f47707c384a1ee785. Real installation tests and the real nested library command passed; retained nested evidence preserves its original seal and provenance.

Measurements use local macOS 27 arm64, locked CPython 3.13.12, one test worker and numerical/Black limits of 1. Each total includes preparation, quality, audit, build, clean installations, tests and report validation; the first run also includes clearing task tool caches. OS/global caches were not cleared. Warm runs execute fresh checks and tests. Linux/Windows local timings and complete release-preparation end-to-end timing are unavailable.

The fresh baseline full run passed 1,831 tests and all 19 then-owned sources in 1,243.637 s. Candidate full is slower at 1,542.579 s and includes additional installation proof and tests. This changes verification cadence; it does not demonstrate a full-suite speedup or meet the abandoned 300 s complete-command objective.

One fresh independent local reviewer accepted this exact candidate with no findings after validating the source, receipts, artifact pairs, hashes, logs, test lifecycles and coverage. Raw logs, current artifacts and all attempts remain outside Git under reports/verification-hierarchy/; final-results.json is the authoritative local evidence pointer. Active strict ci-required protection on codex-main was read back from ruleset 24508475; its existing role bypass is retained. Hosted three-platform CI is separate pending evidence. Merge and publication are not authorized.