Make agentic workflows prove useful progress and real Wasm execution

[mrjf]

Outcome

Make implementation workflows preserve real progress, avoid idle model calls, and require meaningful evidence instead of padded metrics or false-green tests.

• Fix a remaining memory-transport defect after Restore agentic workflow publication, memory, and CI verification #495: the pinned publisher's glob matcher rejects root-level state files. Keep Markdown-only restrictions with extension validation; test against the actual pinned framework implementation.
• Add a read-only Goal preflight so an empty queue does not start the model. Preserve explicit dispatch/slash steering; fail visibly on unavailable GitHub evidence rather than guessing no goals or no PR.
• Require actual implementation/runtime assertions before completion. Autoloop rejects unrelated file generation, count-only parity claims, unequal benchmarks, and missing/ambiguous metric direction; constrain each checkpoint to 64 patch files.
• Reconcile pending published candidates before automatic rejection-plateau skipping; preserve explicit stop policies and expose accurate scheduler metadata.
• Add source-built Wasm verification, including a negative control proving a missing binary cannot pass, exact-SHA/toolchain/binary-digest artifacts, real parity, Rust/core tests, typecheck, and lint. Existing Wasm parity tests now fail instead of silently returning if the module cannot load.

Protected program definitions, issue #1, README, repository settings, and credentials are unchanged. The separate numerical Wasm defect is tracked in #496 and is being exercised through Goal.

Validation

• 73 workflow regression tests pass (including real pinned memory transport validation).
• 9,325 unit/property tests pass with 225,169 assertions.
• Strict TypeScript passes; lint passes with pre-existing warnings.
• All five Agentic Workflow sources compile with gh-aw v0.87.10; generated locks included.
• apm compile: repository has no apm.yml; no APM project to compile.
• Local missing-Wasm negative control fails as intended; real module parity passes 62 tests / 76 assertions.
• GitHub source-built Rust/Wasm and PR CI still to verify on this branch.