feat(control-plane): make evidence-log read enforcement hard-only with failure receipt escape

[huangruiteng]

Summary

Make the replan required-read enforcement for the agent-scoped evidence log hard by default and hard-only. The previous release introduced a soft mode that only surfaced a warning; this PR deletes the soft path entirely, so an ACK that closes an autonomous-replan obligation must be backed by a fresh evidence-log read receipt.

It also adds the agreed failure escape hatch: when loopx evidence-log itself fails, the CLI best-effort records a status="failed" rollout event, which projects as an evidence_log_read_failed warning receipt. The receipt satisfies the hard gate (the agent attempted the required read) while keeping the failure visible in replan ACK feedback instead of silently passing.

Changes

• loopx/control_plane/work_items/autonomous_replan_ack.py: hard-only receipt validation; failed-read receipts accepted with evidence_log_read_failed warning; removed the soft branch and the pre-trigger ACK early-return that let stale ACKs bypass fresh-read validation.
• loopx/control_plane/runtime/agent_scoped_evidence_log.py: receipts accept status completed/failed; failed receipts carry an error field.
• loopx/cli_commands/evidence_log.py: on read failure, append a best-effort evidence_log_read / status=failed rollout event before returning the error; escape-hatch append failure never masks the original error.
• loopx/control_plane/goals/goal_frontier/__init__.py, loopx/control_plane/quota/should_run_prepare.py, loopx/control_plane/__init__.py: removed required_read_enforcement plumbing and the soft policy summary; feedback now surfaces required_read_not_executed or evidence_log_read_failed from the validation warnings.
• docs/reference/protocols/agent-scoped-evidence-ledger-v0.md, docs/status-data-contract.md: document hard-only enforcement and the failure-receipt escape.
• Tests updated/added in tests/control_plane/test_replan_required_read_receipts.py and tests/control_plane/test_goal_vision_blocked_successor.py; the replan decision-plane smoke now models read receipts for ACK scenarios.

Validation

• loopx canary premerge --from-git-diff --goal-id loopx-meta --tier standard: passed (diff hygiene, py_compile, 9 catalog canaries, 8 risk-profile smokes, public/private boundary scan, valid change-quality receipt).
• Targeted pytest (104 tests): passed.
• Control-plane smokes (quota replan decision plane, evidence-log, replan obligation + read model, heartbeat quota flow, goal-frontier replan rules, quota heartbeat state machine): passed.
• mypy (strict, repo-declared files): passed.
• ruff check --select F on changed Python files: passed.
• Known skips/failures: full pytest has 21 pre-existing failures (subprocess Python 3.9 resolution in this dev environment and stale model-behavior qualification fixtures); reproduced identically on the base commit, unrelated to this diff, and excluded from this gate.

Product / Architecture

• Motivation: replan novelty only works if the agent actually reads its coverage ledger; a soft warning was routinely ignored, so the required read was not executed.
• Solved: yes — the only path through replan ACK settlement now requires a fresh read receipt or an explicit failed-read attempt, with the failure kept visible.
• User/operator impact: agents that skip the required read are directed to run it before ACK writeback; command failures no longer deadlock the agent.
• Main risk: installed users upgrading mid-flight could see previously accepted ACKs rejected; mitigated by the failed-read escape and by the fresh-window design (only ACKs that respond to a new obligation instance are checked).
• Design judgment: reuses the existing receipt/rollout pipeline rather than adding a parallel mechanism; deleting the soft mode keeps one enforcement path instead of two.

Manual holds

None. Self-merge after canary + receipt.