Honor terminal routes and preflight privacy persistence

[coreytshaffer]

Summary

• implement CR-125: make human_handoff and the currently unimplemented deterministic resilience routes terminal before backend execution
• implement CR-126: preflight complete tc run packets before ledger creation and persist fixed content-withheld metadata instead of raw prompt/data text
• extend persistent-artifact auditing for high-confidence PII, credentials, and precise-location patterns without echoing detected values
• update architecture, evidence-schema, reviewer, backlog, changelog, and focused regression coverage

Reconciliation

This branch originally claimed CR-123/124 while parallel work merged different canonical CR-123/124 changes into main. Reconciliation commit f7bef76 merges origin/main normally, preserves main's CR-123 Evaluation Handoff Contract and CR-124 Eval Handoff Hygiene, removes the superseded internal-scoring scope, and renumbers the distinct runtime fixes to CR-125/126. No rebase or force-push was used.

Scoring and score interpretation remain external to TriageCore. The next eval-lane candidate remains a separately approved deterministic bundle/manifest builder.

Impact

Privacy-blocked runs now exit before creating ledger residue. Successful tc run records contain content-withheld metadata and input lengths rather than prompt/data content. Governed terminal routes return handoff_required, record worker_result_status=not_attempted, and do not invoke a backend.

Validation

• focused reconciliation suite — 116 passed
• python -m pytest -q — 945 passed, 2 skipped
• python -m triage_core.tc_cli audit --privacy-invariants — 698 records passed
• git diff origin/main --check — clean