fix: harden adaptive policy block evidence

[chubes4]

Summary

• correlate URL-attributed and URL-less console failures with network failures before applying policy-block promotion, yielding one canonical fingerprint per logical failure
• preserve the historical console-message fingerprint when oraclePolicy.policyBlocks promotes an expected block
• deterministically sort and bound retained networkFailures by count and artifact allocation while preserving full aggregate/truncation metadata

Post-Merge Hardening

This follows #2097 after it merged before review completed and addresses the two residual findings from #2093:

• correlation no longer depends on whether an expected policy block is evidence-only or promoted; URL-less Chromium console records pair by failure token
• policy-block floods retain total, retained, policyBlocks, oracleFindings, and truncated summary evidence without exhausting adaptive artifacts or error budgets

Compatibility

Existing URL-attributed console fingerprints remain canonical. The default policy-block behavior remains evidence-only, and oraclePolicy.policyBlocks: \"finding\" still opts into findings without introducing a duplicate network fingerprint.

Tests

• npx tsx --test tests/browser-adaptive-exploration.test.ts (23 passed)
• npm run test:browser-accessibility-oracles (49 passed)
• npm run build (passed)
• git diff --check (passed)

References #2093
Follow-up to #2097

[chubes4]

Addressed both requested changes in 6fe8679f:

• URL-attributed console/network correlation now requires both exact URL and matching Chromium ERR_* failure token. Same-URL unrelated product errors remain findings in evidence mode and coexist with the genuine block fingerprint in finding mode.
• retained networkFailures now consume one artifact-wide count/byte allowance. Every transition still reports deterministic full aggregate/truncation metadata after the retained allowance is exhausted.
• repeated-flood coverage produces three 80-block transitions, retains two failures total across the artifact, reaches the later four-action defect, and verifies deterministic error budgets, minimization, replay, and output.

Validation:

• focused adaptive suite: 24 passed
• broader browser-oracle suite: 50 passed
• npm run build: passed
• git diff --check: passed

Ready for re-review.

[chubes4]

CI coverage is now fixed on rebased head 9c389111:

• Agent Task Contracts pull_request and push filters now include the adaptive core, explorer, and focused test paths.
• The required contracts job now runs npm run test:browser-accessibility-oracles after build.
• Local pinned actionlint v1.7.7 passed.
• Local build and browser-oracle suite passed (50 tests).
• Fresh GitHub checks are green: both contracts runs passed and both workflow-lint runs passed.

Ready for final review. No merge performed.