feat: add citation profile split

[Stahl-G]

Summary

• add ReportTemplate citation profiles (executive / analyst / audit) and resolver metadata for finalize reports
• record citation profile projection in report bundle manifests while keeping reader delivery reader-safe and audit trace retained
• update packaged/root template configs, BriefLoop skill references, Hermes projection, docs, and freshness guard

Boundaries

• no gate behavior change
• no delivery approval or release authority
• no semantic support proof
• no audit trace removal

Validation

• python3 -m pytest -q
• python3 -m pytest -q tests/test_report_bundles.py tests/test_finalize_delivery_gate.py::test_finalize_applies_report_template_order_before_delivery tests/test_finalize_delivery_gate.py::test_finalize_records_citation_profile_override_without_reader_internal_ids tests/test_status.py::test_status_projects_report_template_section_order_without_writes
• python3 scripts/check_skill_contract.py
• python3 scripts/check_briefloop_skill_freshness.py
• python3 scripts/sync_hermes_plugin_skills.py --check
• python3 scripts/check_runtime_asset_parity.py
• python3 scripts/generate_agent_configs.py --check
• python3 scripts/check_release_consistency.py --no-tag
• python3 scripts/check_version_consistency.py
• python3 scripts/check_capabilities.py
• python3 -m compileall -q src tests
• git diff --check

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 080e519918

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Add span-ID residue checks before packaging delivery

When a finalized reader artifact contains an audit-only Evidence Span Registry ID such as ESP-001-01, this new bundle scan still passes because detect_reader_residue does not match ESP-* span IDs. In workspaces where audited markdown accidentally leaves a span ID in the reader text, packs bundle --write-archives can produce a delivery archive that violates the citation-profile contract that reader delivery must not expose span IDs; extend the reader-residue detector before treating this scan as clean.

Useful? React with 👍 / 👎.