Keep model-authored acceptance from carrying a setup command

[ppXD]

Summary

• A supervisor reply could author acceptance.setupCommand and acceptance.timeoutSeconds.
  • The schema never offers them, but its additionalProperties:false is advisory (JsonSchemaValidator does not read it), and a schema-less fallback carries no schema at all.
  • The projector froze both into the ledger, and every supervisor grading lane ran them.
  • ModelAuthoredAcceptanceConverter now sits on the four decision slots: plan subtask, plan phase, stop, and amend replacement. It drops both knobs on read and on write, which also covers ledger rows stored before this change.
  • Operator specs (node config, AgentTask.Acceptance) keep both.
• The grader bounds every step's window (setup, check, oracle-restore git): 0 or less grades at 300 s, and anything above 3600 s is capped at SupervisorLane.MaxAcceptanceGradeTimeoutSeconds. The supervisor lanes never validate the contract, which is why the bound lives in the grader.
• An operator contract is validated, so it is no longer rewritten silently.
  • AgentAcceptanceContract.ValidateAuthored refuses a timeoutSeconds outside 1..3600 and names the ceiling.
  • agent.code fails at staging.
  • The executor's and local verifier's contract check fails closed as SpecIncomplete before anything runs.
• SupervisorTurnService.ReadStopAcceptance is internal and pinned directly. The stop-gate stored-row test now exercises the production reader, not a copy.
• The GradeDirectoryAsync doc no longer claims that grading the live workspace is equivalent to grading a clone. OraclePaths pin only literal files.
• Owner-visible changes:
  • A stored workflow whose acceptance timeoutSeconds is 0 or less, or above 3600, now fails at staging with a named message instead of grading under a rewritten window.
  • In-flight supervisor decisions that already carried either knob grade without it from the next fold.
  • EvaluatorVersion moves to supervisor-acceptance/v8.

Test plan

• Unit: an 8-case route × stored-row Theory (plan fold, spawn, stop gate, amend overlay); a write-side strip; operator round-trip; member-classification pin; bounded-window Theory; the ValidateAuthored window Theory; agent.code staging Theory (7200 / 0 refused, 900 kept)
• Integration: SupervisorModelAcceptanceSetupFlowTests; LocalAcceptanceVerifierFlowTests (an out-of-range window is SpecIncomplete and runs nothing)
• Regression: full unit suite (11875 passed, 1 skipped); integration Acceptance|TaskLaunchFlow|PlanMap|AgentNodeFlow|SupervisorStop (287 passed)
• Mutation: disabling the window rule fails 6 rows; reading the stop acceptance around the converter fails the stop-gate row