Correct control-loop Layer 7 semantics

[anthfuller]

Summary

• preserve all seven F7-LAS architectural responsibility layers while presenting a six-stage runtime workflow
• define Layer 7 as lifecycle-wide monitoring and evaluation for result validation, audit, telemetry, evidence, and assurance
• show runtime stages and terminal outcomes flowing into Layer 7 observation
• preserve approval, PDP permit, PEP authorization, scoped execution, and governed-feedback semantics
• update accessible diagram documentation, canonical hashes, validation rules, and negative tests

Validation

• 127 automated tests passed with checksum-verified OPA 1.20.2
• clean-user acceptance passed
• documentation, citation, traceability, supply-chain, prompt, policy, allowlist, settings, and contract validation passed
• canonical execution, evidence verification, and deterministic replay passed
• golden evaluation passed: 4/4 scenarios, success rate 1.00
• dependency audit reported no known vulnerabilities
• full-history Gitleaks scan passed across 690 commits
• deterministic rerender reproduced both PNGs byte-for-byte

Scope

This change does not modify either whitepaper, Zenodo, tags, releases, or release assets.