[3/5] Make SDK evolution evidence fail closed

[ebarti]

Summary

• parse resolver updates once as exact package/from/to transitions and reuse them across collection and deterministic gates
• derive canonical locked-baseline expectations from collected package evidence, including no-update runs
• contain isolated behavior setup, install, execution, timeout, and malformed-output failures as bounded structured evidence
• compute fail > incomplete > changed > pass from raw probes, diffs, full probe pairing, and trusted expectations
• recompute the canonical assessment for reports and implementation gates instead of trusting a cached headline
• persist behavior_summary.json, include it in the current-state manifest, and surface snapshot/behavior errors and reasons in the Markdown report
• require exact API-diff transitions and fail closed on missing, malformed, contradictory, incomplete, or breaking behavior evidence

Stack

• Depends on [2/5] Observe locked SDK baselines accurately #52
• This is layer 3 of 5 in the SDK evolution demo reliability stack

Review notes

The layer received a two-pass correctness review. Review findings covered drifted no-update baselines, contradictory cached summaries, malformed nested details, failure precedence, partial probe sets, empty self-declared expectation scope, and real breaking-payload coverage; all were repaired and re-reviewed with no remaining actionable findings.

Validation

• PYTHONPATH=. .venv/bin/python -m pytest -q — 449 passed, 12 skipped
• focused SDK evolution suite — 90 passed
• .venv/bin/ruff check .
• .venv/bin/mypy
• uv lock --check
• git diff --check

Security-diff scans were intentionally not part of this phase review.