Honor protected-branch completion evidence in cross-repository lifecycle reconciliation

[rmcdaniel]

Problem

Cross-repository lifecycle reconciliation can replace already verified completion with pending:no-linked-pull-request when work landed directly through a protected branch rather than through a linked public pull request. The affected issues already contain trusted completion records with exact commit identities and required GitHub Actions runs, but later reconciliation leaves them open as if no landing evidence exists.

This creates a stale public backlog and makes completed work look unfinished.

Acceptance criteria

• Recognize authenticated protected-branch completion records as valid provenance alongside linked pull requests.
• Verify every claimed commit is reachable from the declared target branch and every required qualification run belongs to that repository, workflow, commit, and successful conclusion.
• Accept completion markers only from trusted organization actors; issue bodies and comments from untrusted authors cannot manufacture completion.
• Preserve explicit evidence holds, reopen reasons, regressions, and superseded states even when earlier completion evidence exists.
• Do not emit pending:no-linked-pull-request after all declared targets have valid protected-branch completion evidence.
• Add regressions for direct protected-branch completion, mixed PR/direct completion, forged comments, a later evidence hold, and a superseded authority.
• Reconcile the existing public backlog once so completed and superseded issues remain closed.

Delete when

Delete when lifecycle reconciliation produces the same terminal state from verified protected-branch evidence as from a linked implementation pull request, and the existing stale completed issues stay closed on the next scheduled pass.