feat(miner-hands): immutable acceptance-criteria file written before the coding agent starts

[JSONbored]

Before a coding-agent driver (#4262's interface; #4266/#4267's implementations) starts editing, the miner needs to pin down — immutably, so the agent can't quietly redefine its own success bar mid-attempt — what "done" means for this attempt. The natural source of truth is the two Phase 2 primitives that are already done: buildFeasibilityVerdict/FeasibilityGateResult (packages/gittensory-engine/src/feasibility.ts, the go/raise/avoid verdict plus reasons) and buildPromptPacket/PromptPacket (packages/gittensory-engine/src/prompt-packet.ts, the sanitized taskBrief/feasibilityNotes/retrievalContext/constraints fields — explicitly documented as "the analysis→coding-agent boundary membrane"). This issue turns those into a single written-once file. It also has a direct home already reserved in the plan-template library: preparePlanTemplate's coding-agent step (packages/gittensory-engine/src/plan-templates.ts:84, actionClass: "codegen") runs immediately after branch-create and before local-test — this file is what that step should hand the driver.

Deliverables

• packages/gittensory-engine/src/miner/acceptance-criteria.ts (path coordinated with feat(miner-hands): define the CodingAgentDriver interface seam #4262) exporting a pure builder that composes a PromptPacket (packages/gittensory-engine/src/prompt-packet.ts:26) and a FeasibilityGateResult (packages/gittensory-engine/src/feasibility.ts:21-26) into one acceptance-criteria document — reuse sanitizePromptPacketField (packages/gittensory-engine/src/prompt-packet.ts:38) rather than re-implementing redaction, since this file is exactly as exposed to a prompt-injectable coding-agent session as the prompt packet already is.
• A serialization format decision (markdown vs. JSON) and a fixed on-disk filename convention, written into the attempt's worktree (feat(miner-hands): git-worktree-per-attempt isolation primitive #4269, this batch) before the driver (feat(miner-hands): CLI-subprocess CodingAgentDriver (reuse SpawnFn/redactSecrets/EFFORT_TIMEOUT_MS pattern) #4266/feat(miner-hands): Agent-SDK CodingAgentDriver (query() loop) #4267) is invoked.
• "Immutable" as a real property, not just a naming convention: document (and, where practical, enforce — e.g. a checksum recorded alongside, or filesystem permissions) that once written, this file does not change for the lifetime of the attempt, so a self-review step (maintainer-only issue maintainer: local create->score->self-review iterate-loop orchestrator (the control-flow core) #2333's iterate-loop) can trust it as a stable target across iterations.
• Unit tests covering composition from both inputs, the redaction pass-through, and a case where the feasibility verdict is raise/avoid (should the file even be written in that case, or is that gated upstream by the plan? decide and document).

References

• packages/gittensory-engine/src/feasibility.ts:19-26 (FeasibilityVerdict, FeasibilityGateResult)
• packages/gittensory-engine/src/prompt-packet.ts:15-46 (PromptPacketTextField, PromptPacket, buildPromptPacket, sanitizePromptPacketField)
• packages/gittensory-engine/src/plan-templates.ts:78-87 (preparePlanTemplate — the coding-agent step this file is the direct input to)
• Coordinates with feat(miner-hands): define the CodingAgentDriver interface seam #4262 (this batch) on how the driver interface receives this file (path vs. inline content)
• Coordinates with feat(miner-hands): git-worktree-per-attempt isolation primitive #4269 (this batch) — the worktree this file gets written into

[linear-code]

JSO-3258