feat(procore): add RulePackV1.1 evaluation

[mcxl]

Summary

Adds a deterministic, certification-oriented RulePackV1.1 contract for project-specific SWMS advisory pre-screening.

• adds a closed Draft 2020-12 JSON Schema and fail-closed pack loader
• evaluates every atomic criterion with exactly one result: aligned, partial, missing, unclear, or unsupported
• supports seven non-executable predicate types with no arbitrary customer logic
• prevents keyword presence from producing aligned
• preserves unconditional baseline review, existing amendment/comment/audit contracts, and stable resubmission issue keys
• permits draft packs only with an explicit flag in non-production environments
• prevents invalid, inactive, missing, or draft production packs from triggering live write-back
• migrates the pilot fixture to a provenance-ready V1.1 draft pack
• updates pypdf to 6.13.3 to clear the dependency audit finding

Safety posture

The integration remains advisory and requires human review. This PR does not change Procore endpoints, OAuth, webhook authentication, Supabase migrations, or Procore UPDATE/DELETE behavior.

The following remain external and explicitly unverified: Procore auth/signature scheme, OAuth/DMSA grant and scopes, final write-back resource/path/API version, and live delivery_id/ulid payload location. Live write-back remains separately gated.

Verification

• focused RulePack tests: passed
• Procore webhook tests: passed
• resubmission, audit, and dependency smoke tests: passed
• full pytest suite: passed in the pre-push gate
• repository flake8: passed
• git diff --check: passed
• pip-audit -r requirements.txt: no known vulnerabilities
• independent DeerFlow review: PASS WITH CHANGES / GO, with no merge-blocking findings

Follow-up

A legacy direct-call status fallback remains for compatibility. It is not reachable as a write-back bypass because the versioned webhook always injects the validated loader status before enforcing the AVAILABLE write-back gate; retirement can be handled in a later hardening cycle.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 25236cc4cb

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".