feat: select the strongest qualified effect verifier

[abrichr]

Summary

Selects the strongest reviewed effect verifier for each resolved effect before actuation. The selected verifier and its pre-action state remain pinned through verification. The runtime never changes to a weaker verifier after input.

Safety contract

• effects.candidates is mutually exclusive with the existing single effects.kind configuration.
• The lowest VerificationTier wins. Declaration order breaks a tie.
• Candidate configuration, credentials, and plugin lifecycle fail before actuation.
• GUI and API actuation capture the selected pre-state before input.
• Durable resume and attended completion read the state for the same resolved effect.
• Uncertain API delivery uses the pinned verifier. It never retries the action or uses a weaker verifier.
• If the selected verifier cannot confirm after input, the run requires reconciliation.

The legacy single-verifier configuration remains unchanged.

Validation

• uv run pytest -q tests/test_effect_verifier_candidates.py tests/test_effect_kit_config.py tests/test_replayer_api_actuator.py — 69 passed
• uv run ruff check on all changed Python files
• uv run ruff format --check on all changed Python files
• strict safety-path mypy on the changed runtime modules
• python scripts/check_consistency.py
• python scripts/check_release_consistency.py
• git diff --check

Hosted required checks are running against exact head 3b3de571399077b12cf84d28a412f77e461e49e7.