feat(receipts): verification receipts for 20 tools across 7 ecosystems with a positive-evidence floor

[fusengine]

Summary

• The TaskCompleted receipt gate previously only recognised tsc and bun test, vitest, jest, npm test, matched anywhere in the raw command, so Python, Go, Rust, PHP, Swift and Dart projects could never satisfy it, and a commit message mentioning jest could forge a receipt.
• Adds a runners table covering bun test, vitest, jest, npm/pnpm/yarn/bun run test, pytest, go test, cargo test, phpunit, pest, php artisan test, swift test, dart/flutter test, plus tsc, mypy, pyright, phpstan, go vet, go build, cargo check, cargo clippy, swift build, each with a per-tool summary parser calibrated on real output.
• A receipt now needs positive evidence (tests executed above zero with zero failures, the tool's own success line, or documented silence with intact output); redirected or piped-away output is not evidence, and a missing exit code means no capture. This is a guard against forgetting to verify and against honest shortcuts, not a security control against deliberate fabrication.

Changes

• New: src/tracking/receipt-command.ts, receipt-runners.ts, receipt-runners-parse.ts, receipt-runners-parse-php.ts, receipt-runners-parse-static.ts
• New tests: receipt-runners.test.ts, receipt-runners-forgery.test.ts, receipt-runners-hardening.test.ts, receipt-runners-evidence.test.ts, receipt-runners-structural.test.ts, receipt-runners-realworld.test.ts, receipt-runners-realworld-2.test.ts
• Modified: src/policy/guards/bash-command-anchor.ts (exports its parts, CMD unchanged), src/runtime/handle-post.ts, src/runtime/lifecycle/agent-memory.ts, src/runtime/lifecycle/task-completed.ts, src/runtime/receipt-capture.ts, src/tracking/receipts.ts, src/tracking/session-state.ts, test/receipts.test.ts
• Version bump commit: package.json and CHANGELOG.md to 0.1.96

Test plan

• bun test: 1837 pass, 1 skip, 0 fail
• bunx tsc --noEmit: 0 errors
• bun run build: success
• Five challenger rounds against real cargo, pytest, PHPUnit and bun captures; a ReDoS in the option-tolerant prefix was caught and fixed

Breaking changes

None