Bound predict-audit ownership-walk + rule-sweep harnesses; consolidate unverified findings

[0xaslan]

Summary

• Bound the ownership-walk and rule-sweep audit harnesses by construction: MAX_ROUNDS default 12→3 (ownership-walk) and 10→3 (rule-sweep), add verifyCap (60), and severity-gate verify (cleanup-tier findings reported raw, no subagent). Total agents ≤ maxRounds×units + verifyCap, so neither harness can run away to the agent cap.
• Each sibling harness now emits an unverified array (Info/Low/cleanup findings triaged out of the verify panel).
• consolidate.py now records those unverified findings — under their own key in findings.json (so track.py doesn't flood the tracker with low-priority noise), kept in the DROPPED 0 accounting (no silent drop), and surfaced in a dedicated Unverified report section.
• Repo hygiene: untrack docs/superpowers/specs/2026-06-23-propbook-block-scholes-feed-split-design.md. It was committed long ago (219a9103) and stayed tracked, so the /docs/ and /docs/superpowers/ .gitignore rules never applied — git skips ignore rules for already-tracked files, which is why these specs kept reappearing in PRs. git rm --cached untracks it (local copy kept); the existing rule now keeps it (and future superpowers specs) out.

Key decisions

• This is the sibling half of the predict-audit harness rework; the orchestrator + SKILL.md half already landed in main via the reference-tick admission PR. The orchestrator-only features (per-lane retirement, cross-model codex verify, depth tiers) are intentionally not ported to the siblings here — that's a separate follow-up.
• The consolidate.py change re-syncs the consolidator with the already-merged orchestrator (which emits unverified), closing a split where the orchestrator landed without its matching consolidator handler.
• Read-only on packages/* — no smart-contract changes; audit tooling only.

Test plan

• python3 .claude/skills/predict-audit/evals/test_consolidate_track.py → ✅ ALL PASS (locks no-slip / id-dedup / tracker invariants; required after editing consolidate.py)
• node --check (runtime-wrapped) parses ownership-walk.workflow.js + rule-sweep.workflow.js
• git check-ignore -v confirms the untracked spec now matches /docs/ (the recurring leak is fixed); local copy retained on disk
• (optional) a scoped rule-sweep / ownership-walk run to watch the bounded caps + unverified flow end-to-end

🤖 Generated with Claude Code