Related to #2537

Summary

• Add a runtime-only internal/evidence ledger for per-turn tool receipts.
• Record successful and failed tool executions in the agent loop without writing receipts to prompts, tool schemas, or persistent session state.
• Verify complete_step verification/diff/files evidence against successful host receipts; manual evidence remains allowed but is marked manual/unverified.
• Keep complete_step read-only, while forcing batches that contain it through sequential execution so receipt ordering is reliable.

Conflict check

• Scoped away from active auto-plan, worktree agent, goal state, cache diagnostics, and MCP startup/import PR areas.
• No UI changes.
• No performance claims.
• No prompt or tool schema changes.

Review evidence

• No UI changes; screenshots not applicable.
• No performance claims; cache hit rate, token consumption, and runtime metrics are not claimed for this correctness change.
• No prompt or tool schema changes, so cache/token behavior should be unchanged.

Verification

• D:\Go\go\bin\go.exe test ./internal/evidence ./internal/tool/builtin ./internal/agent: PASS
• D:\Go\go\bin\go.exe test ./internal/...: PASS
• git diff --check: PASS

Notes

• The local legacy npm git hook still expects package.json on this Go branch. The commit was made with --no-verify after the Go validation above passed.