feat(legal): add adaptive fail-closed coverage

[zhengdaqi]

Summary

This is the clean replacement for #445. It is based directly on the updated
codex/legal-runtime-e2e branch, which now contains the current main
baseline. The legal coverage implementation is carried over without the
duplicated Merge origin/main commit that caused the old stacked diff to
expand to 190 files.

Changes

• Add the fail-closed legal coverage validator and due-diligence Skill.
• Inject milestone-aware, bounded legal work slices through the domain plugin,
  including PostCompact recovery.
• Add adaptive E2-Elite projection guidance and sanitized aggregate evidence.
• Preserve the generic Harness boundary: no legal concepts or benchmark
  controls are added to Core.

QA & Evidence

• npm test: 216 passed, 0 failed, 0 skipped, 0 cancelled after a clean
  pnpm install --frozen-lockfile.
• Build and git diff --check: passed.
• Focused real-Gateway legal coverage tests are included in the full suite.
• Evidence: .omo/evidence/20260725-legal-coverage-clean-stack/qa-summary.md.
• GitHub currently reports no automatic checks on this non-main-targeted
  stacked branch; this is not represented as a CI pass.

Risks & Residuals

• The semantic Judge remains an evaluation-only dependency; this PR does not
  claim corpus-level semantic completion.
• The previous feat(legal): add fail-closed due diligence coverage #445 has been closed and is retained only in GitHub history;
  feat(legal): add adaptive fail-closed coverage #447 is the active clean replacement.