risk-control actuation: calibrated λ̂ governs the gate under an explicit precedence rule

[JSONbored]

Context

#8848 shipped the risk-control calibration (#8835): daily fixed-sequence recalibration publishes a certified per-arm λ̂ to system_flags (riskcontrol:close / riskcontrol:merge) with the guarantee statement in the audit trail, refusing and retracting when under-powered. Two pieces were deliberately split out because they hinge on a precedence decision:

The decision this issue exists for: ai_review_close_confidence already has an automatic writer — the backtest-gated knob loosening (#8121/#8158, tunables_overrides via getAiReviewCloseConfidenceOverride). Wiring the calibrated λ̂ into the live gate floor creates two automatic writers on one knob. Options:

1. Risk-control wins when calibrated (recommended): a human-label-backed finite-sample guarantee outranks a backtest-derived loosening; the knob-loosening writer is suspended for the arm while a λ̂ is published, resuming automatically on retraction. Rationale: the loosening optimizes throughput under a backtest proxy; λ̂ bounds real error against human ground truth.
2. Max-of-both: act only when confidence clears BOTH floors — safest, but the loosening becomes dead code while calibrated.
3. Keep consult-only forever — rejected by the epic's goal; the guarantee must eventually govern.

Requirements

• Decide and document the precedence rule (option 1 recommended).
• Actuation: when LOOPOVER_RISK_CONTROL is on AND a calibrated λ̂ exists for the arm, the gate's effective confidence floor becomes λ̂; decisions below it HOLD with a reason code naming the calibrated-abstention source (so a held contributor sees why). Fail-open to the static floor on any flag-read error, mirroring isHoldOnly.
• Per-repo calibration where sample size permits (global fallback), per gate: distribution-free risk-control act/hold thresholds, separate Neyman-Pearson bounds per arm #8835's original text.
• Publish the guarantee on the public accuracy surface (metrics: publish per-arm precision, coverage, and Wilson intervals — retire the bare accuracy scalar #8829's fields): "≥(1−α) guaranteed at N% coverage" alongside the empirical figures, only while a λ̂ is live.
• α/δ move from constants to config-as-code (manifest), defaults unchanged.
• Regression tests: precedence both directions, retraction restores the static floor, the hold reason code surfaces.

Test Coverage Requirements

99%+ patch coverage, branch-counted, both arms of every conditional.

Expected Outcome

The certified threshold actually governs the gate under an explicit, documented precedence rule, and the homepage claim upgrades from empirical to guaranteed while — and only while — the guarantee is live.

[linear-code]

JSO-6126