feat: VocationOS 0.7 verified career execution kernel

[OnourImpram]

Purpose

Begin the VocationOS 0.7 line while preserving the immutable v0.6.2 release and the support/0.6.x maintenance branch.

This PR implements the first publishable slice of Full Autonomous Career Operations:

• three-stage opportunity verification,
• independent-source and freshness enforcement,
• legitimacy assessment,
• signed scoped execution grants,
• transactional idempotent Outbox,
• execution-adapter contract,
• synthetic-only shipped adapter,
• trusted confirmation proof,
• executable end-to-end alpha demonstration.

Safety boundary

Alpha 1 does not ship production email or ATS execution authority. The only shipped adapter will be career-ops-local-fixture, restricted to synthetic profiles and synthetic domains. Production adapters are separate later milestones.

Documents

• Design: docs/superpowers/specs/2026-08-28-vocationos-full-career-operations-design.md
• Plan: docs/superpowers/plans/2026-08-28-vocationos-v0.7-alpha1-verification-outbox.md

Development method

Each behavioural task is developed test-first. The PR stays draft until the full npm run safe:publish-check line passes on Ubuntu and Windows and the release evidence is recorded.