feat(95): surface table distrust via tables_trust.json + doc-level pointer

[r-uben]

Summary

Makes table distrust visible to consumers via a tables_trust.json sidecar plus a
document-level pointer.

Dual-pass already detects untrusted tables and records them in audit_log.json,
but on the OBR EFO November 2022 reference run the assembled markdown looked like
clean prose and tables while 20 of the 20 pages carrying tables were flagged,
and metadata.json said only:

status: partial
error:  "page(s) 46 produced no usable output"

One page named. Flag-only is a defensible write policy; it is a bad read policy
when the durable artifacts hide the flags.

Scope / non-goals

• No write-policy change. --auto-patch-tables stays opt-in. This is a
  read-only derivation over existing audit events.
• The assembled .md is untouched. Surfaced table distrust: dualpass flags never reach the consumer .md #95 offers "callout and/or sidecar";
  the sidecar is chosen because the markdown is produced by
  _rewrite_all_fragments, whose byte-identity with whole-doc assembly is guarded
  by golden tests. Prose-only pages therefore stay unmarked.

Implementation

socr/core/tables_trust.py derives tables_trust.json beside audit_log.json.
Top-level summary a consumer can gate on without walking per-page records or
parsing the audit log: untrusted_page_count, untrusted_pages,
table_flags_n, counts_by_kind, patch_eligible_pages.

Distrust taxonomy is explicit, with exclusions documented in the module docstring:
resolved disagreements (dualpass_patched, table_header_repair), passes
(native_table_verifier_exact_pass), and page_failed (not table-specific, and
already surfaced via LOST_CONTENT_NOTE; failed table pages still carry
table_region_unverifiable).

PATCH_ELIGIBLE_NOTE is named in tables/reconcile.py so patch-eligibility is
identified by constant comparison instead of parsing prose out of the audit log.

Doc-level signal: a constraint worth flagging to the reviewer

ocr_output_contract.DocMetadata has a fixed field set — status, checksum, model, backend, processing_time, timestamp, output_path, pages, error, fingerprint, mode, fell_back_from_whole_pdf. There is no slot for a trust count. So the signal
rides in error, prefixed with a stable token for substring gating, appended so a
lost-content or halt reason still reads first.

It reports counts, not the page list: enumerating 20 page numbers made the
field grow with document size. tables_trust.json carries the list.

EngineResult.success derives only from status, so writing error on an
otherwise-clean run is inert for control flow — but that is worth a reviewer's
second look.

What this does NOT establish

Validating the derivation against the real audit log broke a claim in the
bake-off note (corrected there):

• Page 66 is flagged, by value_guard_row_count_warning. So 20 of 20
  table pages are flagged and there are no negative controls.
• Recall is trivially 100%; precision cannot be measured and is visibly poor —
  page 45 scores 100.0% cell exactness and is flagged, page 67 94.1%, page 66
  91.2%.

So this sidecar is a triage list ("look at these"), not a trust verdict
("these are wrong"). It satisfies #95's acceptance — an outsider can name an
untrusted page without reading audit_log.json by hand — but a consumer must not
read untrusted_pages as the broken set. Severity ranking is a follow-up.

Test plan — observed results

• pytest tests/test_gh95_tables_trust.py -q → 17 passed
• pytest tests/ -q → 1252 passed, 1 xfailed
• ruff format --check + ruff check on all four touched files → clean
• Validated against the real audit log: reproduces 20 untrusted pages, 46 flags,
  counts_by_kind matching the run, and 8 patch-eligible pages.

All tests are pure derivations over AuditEvent objects — no engine, no provider
ladder, so hermetic in CI without patching _available_engines_for_agentic.

Includes a taxonomy guard that fails if a watched kind is never emitted anywhere
in src/, to stop a typo silently disabling a signal.

Merge order

table_row_repetition_truncated is watched here but emitted by #97 (PR #99). The
taxonomy test lists it as pending and is forward-compatible in both directions —
deliberately not a tripwire that fails once #99 lands. Either merge order is
safe.

Closes #95