feat(trace): assert_no_side_effect turns side-effect observation into a verdict (#465 Phase A, 4/5)

[AminChirazi]

Part 4/5 of #465 Phase A. Stacked on 3/5. The falsifiability proof and the deep-dive docs section follow immediately in 5/5 (this PR + 5/5 were one commit in the design; split to respect the 400-line ratchet — this PR carries the full unit-test proof of all three verdict directions, 5/5 carries the CLI-level red path).

What

- assert_no_side_effect: fs_write | http_request (reserved kinds refused with their own "reserved for a later phase" parse error). The verdict copies assert_no_egress's honesty ladder: cannot certify where observation cannot run (macOS/Windows/url: — never a vacuous pass, no bypass), cannot certify on relevant supervisor faults (an empty effects list under a blind supervisor is silence, not evidence), then the set predicate. Violation classification is structural, not lexical: messages start with the SIDE_EFFECT_VIOLATION sentinel and is_capability_error yields to that prefix first, so an agent that unlinks a file literally named ./cannot certify.txt cannot relabel a real violation as a capability error (unit-pinned both directions). A flow carrying only this assertion runs supervised on Linux via a cfg-gated drive arm under AllowSet::allow_all(); prediction and achieved tier agree (observation_only), so the report never prints two contradicting tier lines. A violating record mints no trace; replay judges the live re-run's log (the lane is audit, never authority). authoring.md step row included; docs sentences that this assertion falsified ("no spec surface", "only where containment is already engaged") are corrected in the same range.

Evidence

fmt 0 · clippy 0 · cargo test --workspace 0 · Linux cross-check 0 · ratchets.sh exit 0, diff 395/400.

🤖 Generated with Claude Code