Build an offline-tested calibration batch driver

[rivendale]

Adds the fixed 58-pair/116-request calibration driver using reviewer.review, Relay.review_request and the existing Relay key policy. Runner and driver share one factored inherited-FD helper. Record rows remain strict 4/6-key objects; run-id directories, event IDs, exclusive writes, reconstruction and receipt hashes bind the batch. Unchanged disk scorers run before final receipt verification; score_exit 1 remains 1 and review_gate always stays false.

The operator --run entry now verifies committed tracked sources and rejects untracked importable source/bytecode BEFORE adding the runner import path. A subprocess regression test demonstrates that an untracked runner module is refused without executing it. run.py's original 100755 mode is restored with unchanged content.

CI now requires the actual reviewer renderer and has no optional renderer skips. A missing convert fails the job. CI setup installs ImageMagick from the runner Ubuntu archive with sudo apt-get install -y imagemagick. No other package target, pip/npm install or alternate renderer is added. The test code remains offline with synthetic providers. CI run38990941588 now passes at bb929ac: all33 tests and all21 mutations executed, including the rendered collection and receipt suites; no renderer skips.

Validation at bb929ac: 33 offline tests and 21 behavioral mutations pass locally. Full mock batches use the real reviewer/Relay method with mocked HTTPS, make 116 requests, persist 42+16 rows, run both disk consumers and verify receipts. The ten failure directions are mapped in DRIVER-VALIDATION.json. Cases include copied-in files, event identity, partial/incident/write/readback failures, strict usage accounting, request 117 refusal, scorer preservation, shared intake and pre-import source checks.

The operator-held first batch was checked again: exact hashes/reconstruction match, its known scorer exit 1/four failed floors stay unchanged and self-comparison exits 0. tests/test_driver_fixture.py --fixture PATH is the rerunnable command; default fixture absence is reported explicitly and does not claim that check ran. Only checksums and small authored synthetic data are committed. The owner will perform the held-fixture check before live execution.

Not performed: real credential/provider/paid runs or refreshed container/isolation validation. Independent review occurred at the previous head; Claude verification of these fixes remains open; required rendered CI is green. Draft, no approval, merge or calibration acceptance. Extra/unpriced usage categories still stop the batch rather than silently omitting cost.

[rivendale]

Claude re-review at bb929ac: findings 1 (CI now installs ImageMagick and requires the renderer; 33 tests and 21 mutants ran in run 38990941588), 3 (run.py mode restored) and 4 (pre-import source identity refuses untracked importable files) fixed. Finding 2: operator fixture check runs before the live batch. Finding 5 stays a documented fail-closed stop. Clear to merge.