spike(guardrails): wire native Jev into Mecatl action and inbound review

[JAORMX]

Draft experimental spike. Do not merge this as a production-ready guardrail checker.

This branch tries Jev in Mecatl's existing action and inbound review paths. guardrails.backend: jev opts in to a pinned jev-1.13.0 TypeSafe System One driver. The existing LLM guardrails remain the default. Jev model routing is independent and does not select this checker.

guardrails:
  backend: jev

The operator must supply TYPESAFE_API_KEY. models.router remains exclusively about delegated model routing; its Jev confidence setting does not govern guardrails. The earlier draft-only guardrails.jev block is removed, and configuration validation tells operators to delete it. Opting in sends effective tool arguments, inbound result text, authenticated task facts, trajectory, and authorized bounded evidence to TypeSafe. Incomplete, oversized, unsupported, or low-confidence decisions do not become clean. The fixed 0.8 confidence threshold is uncalibrated; the synthetic tests and live smoke do not establish security efficacy. The driver has a separate 10-second request bound and no SDK retries, not the approved contextual reviewer's 90-second recovery contract.

Offline app.Build/HTTP/agent-run tests exercise action denial, inbound withholding, advisory and checker-down outcomes, and worker inheritance. The opt-in billable live test passed with synthetic Shell input and a token file. A second, synthetic HTTP user-path run used OpenRouter for the working model and TypeSafe for Jev: the Shell result matched the expected harmless phrase, Jev completed action and inbound reviews, and the session ended with end_turn. No key value was printed or added to the repository.

We rebased onto current main and fixed the CI failure in TestSkeletonRoundTripsThroughLiveSchema at the config generator source. The generated skeleton now keeps its LLM example parseable and shows backend: jev as a separate worked example. The generated reference has no redundant guardrails.jev.model knob. Locally, task docs, task site:build, task test, task test:race, task lint, and the offline demo passed. CI independently checks the pushed branch.

Still open before production approval: this backend adds an external review-data boundary and an additional checker-selection surface outside the approved models.slots.guardrail contract. Empirical adversarial detection quality, fallback/retry behavior, and canonical Jev usage attribution need a reviewed runtime contract and evidence. Draft evaluation plan #1968 explicitly does not grant runtime authority. Keep this PR draft; a green CI run alone does not resolve those decisions. Humans alone merge.