Wire the verdict seam to real hermetic per-PR CI

[ronimoe]

Context

BatchEngine.tick(verdict, ...) takes a verdict(spec_tree, members, reps) -> BatchVerdict seam; today it's fed by from_green/fakes. Production must run the repo's real CI against the spec tree under repetition and return per-test DET_PASS/DET_FAIL/UNRESOLVED.

Scope

• Dispatch a GitHub Actions run (or check-run) per spec ref; collect per-test outcomes across reps.
• Map results into BatchVerdict.per_test; run under the hermetic test runtime (see hermetic-test-runtime issue).

Acceptance

A real PR lands end-to-end on a sandbox repo via Actions; a flaky vs deterministic-red test is classified correctly from real runs (no masking).

Seam

tools/conductor/verdict.py, batch_engine.py (the verdict param).

[ronimoe]

Implemented in ddd23b3.

ci_verdict.py bridges real per-PR CI into the engine seam: CheckRunVerdict(fetch) reads the conductor-spec check-run report and returns a BatchVerdict (per-test across reps); a failed drift probe (non-hermetic runtime) fails closed rather than landing a flaky-green. Unit-tested in test_integration.py (suite + per-test classification, non-hermetic fail-closed, the seam itself).

Remaining for full close: validate end-to-end on a live repo — the production fetch reads check-runs via gh api inside tick_runner.py, which needs a live repo + Actions to exercise. See tools/conductor/INTEGRATION.md.