[1/5] Plan SDK evolution demo reliability repairs

[ebarti]

Summary

• records the reproduced false-green and missing-baseline failure modes on current main
• defines the evidence invariants, First Principles model, Five Whys, and owning fix layers
• lays out a five-PR delivery stack with exact files, tests, acceptance criteria, and report-only rehearsals
• keeps the replacement stack independent of stale open PRs Add reusable SDK evolution upgrade script #19 and Overhaul SDK evolution workflow #40

Why

The Agent SDK stages execute successfully, but the documented evolution workflow can label ambient import failures as locked SDK evidence, collapse incomplete probes into a passing headline, and permanently fail CLI-binary snapshots through the wrong module name. The repair needs to preserve the explicit candidate-inspection and credential-scrubbing boundary while making the supported command actionable.

Stack

This is PR 1 of 5 and contains planning documentation only. The implementation branches will be based in order on this branch:

1. truthful locked-baseline collection
2. fail-closed evidence summaries and exact transition gates
3. Codex CLI binary introspection
4. actionable runtime-specific operator commands and documentation conformance

Validation

• git diff --cached --check
• reviewed against origin/main at 2e7e4c3
• checked against the current implementation, tests, documentation, and live PR topology