fix: close topology review gaps

[Stahl-G]

Summary

• sync the checked-in Hermes skill and delegate-task reference with the default-topology Screener replay ban
• add a checked-in Hermes skill contract regression so source-clone users do not receive stale guidance
• reject screened entries missing candidate_id when candidate_claims.json provides a stable candidate universe

Review Notes

• The older fix: harden topology-satisfied handoff guidance v2 #347 replay-ban comment against 983dd64 was fixed before merge by deriving bans only when satisfied_by is a workflow stage.
• The older test: guard screened discard universe counts #348 completion-preflight comment against 29d7a98 was fixed before merge by moving screened universe validation into _validate_artifact.
• This PR addresses the remaining post-merge comments on checked-in Hermes skill sync and missing screened candidate IDs.

Validation

• python3 -m pytest -q tests/test_runtime_state.py -k "screened_candidates"
• python3 -m pytest -q tests/test_subagent_first_contract.py tests/test_skill_contracts.py tests/test_hermes_adapter.py -k "Hermes or hermes or topology or scout or skill"
• python3 scripts/check_skill_contract.py
• python3 scripts/check_release_consistency.py --no-tag
• python3 scripts/check_product_baseline.py
• python3 scripts/check_runtime_asset_parity.py
• python3 scripts/check_briefloop_skill_freshness.py
• python3 scripts/check_capabilities.py
• git diff --check

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c716fa32d2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Check stable IDs without requiring totals

Because _screened_candidates_candidate_universe_error returns before this loop unless _screened_candidates_total finds a declared total_candidates/count, this new missing-ID rejection never runs for otherwise-valid screened payloads whose screening_policy only contains fields like max_items (a shape the validator accepts elsewhere). In that scenario, even with a valid candidate_claims.json whose candidates all have stable IDs, a selected or discarded item missing candidate_id is still marked valid, leaving downstream Claim Ledger/coverage traceability to statement matching. Base the missing-ID/unknown-ID check on the stable candidate IDs themselves rather than on an optional declared total.

Useful? React with 👍 / 👎.