maintainer: iterate-loop stop/abandon/handoff policy + Phase 4 handoff contract

[JSONbored]

Define and enforce the explicit POLICY the orchestration loop's control flow consults to decide, each iteration, among exactly three outcomes: keep iterating, stop-and-hand-off-to-Phase-4-submission, or abandon-silently. This is deliberately split out from the raw control-flow issue so the POLICY (the actual thresholds/rules — e.g. "abandon after N consecutive non-improving iterations", "never hand off without a clean predicted-gate PASS", "disengage silently on any rejection signal rather than retry-hammering") is a distinct, individually reviewable artifact from the LOOP MECHANICS, even though both are maintainer-tier and will likely land as companion PRs.

Also defines the literal handoff CONTRACT to Phase 4 (a not-yet-built submission surface) — the exact shape of data a completed, self-review-passed attempt hands forward, so Phase 4 (built later) has a stable interface to target instead of reverse-engineering it from the loop's internals.

Deliverables

• packages/gittensory-engine/src/miner/iterate-policy.ts exporting a pure decideNextAction(state: IterationState): "continue" | "handoff" | "abandon" function, fully unit-testable without a real driver/worktree
• Policy encodes: a hard iteration ceiling, a "no progress" detector (e.g. the self-review verdict's blocker set is identical to the prior iteration's — stop wasting turns), and a mandatory clean predicted-gate PASS as a handoff precondition (never handoff on anything else, including an ambiguous/errored self-review)
• HandoffPacket type documenting the exact fields Phase 4 will need (worktree path or branch ref, final diff summary, the passing self-review verdict, the attempt-log reference) — this is a forward-looking INTERFACE definition, not an implementation of Phase 4 itself
• Owner-reviewed tests covering every branch of decideNextAction (continue, handoff, and every distinct abandon reason) as pure unit tests with synthetic IterationState fixtures
• A short doc note on the "disengage silently on rejection" principle (no retry-hammering a repo that has signaled unwanted-AI-PR policy) and where the loop consults it

References

• packages/gittensory-engine/src/miner/iterate-loop.ts (the mechanics this policy plugs into, sibling maintainer issue in this batch)
• packages/gittensory-engine/src/miner/self-review-adapter.ts (the verdict source this policy's handoff precondition reads, sibling maintainer issue)
• User memory note "gittensory-miner-autonomy-roadmap": "disengage SILENTLY on rejection (Matplotlib "MJ Rathbun" cautionary tale)", "reward MERGED net-positive (never submission volume)", and "never auto-submit (P4) before governor+caps (P5)" — the exact strategic constraints this policy encodes
• src/settings/autonomy.ts lines 20-27 (resolveAutonomy, isActingAutonomyLevel — cite as the existing reusable autonomy-dial pattern this policy's eventual autonomy-level check, when wired to a real config, should consult; wiring to a live autonomy config is left to a later phase since .gittensory-miner.yml's autonomy fields are not yet defined)

[linear-code]

JSO-2432