Chameleon

Finding->fix loop closure (roadmap #9). The correctness judge and multi-lens
review can never block, and nothing tracked whether a surfaced advisory was ever
acted on — so a dropped high-severity finding was simply lost, with zero
telemetry on whether the model acts on reviews. Advisory (no deny path).

Added

• Surfaced-finding ledger + one re-surface (default on; kill with
  CHAMELEON_FINDING_LEDGER=0). Each finding the multi-lens review or the
  synchronous correctness judge surfaces at Stop is persisted to a new
  judge_findings drift.db table with the reviewed file's content digest as an
  anchor. The next Stop re-checks each open finding BEFORE that turn's gates run:
  the cited file changed (or is gone) since review => addressed and dropped;
  unchanged => still open. An unaddressed HIGH-severity finding (correctness
  confidence >= 0.7, or a multi-lens finding two lenses independently agreed on)
  is re-surfaced exactly ONCE, then never nagged again. Severity is normalized
  across the lens shapes (correctness findings carry confidence, not a
  severity). Off the per-edit hot path (Stop only), fail-open, bounded, sanitized;
  the durable table is trimmed by the same age+recency policy as the other drift
  tables. The re-check is scoped to the workspace that persisted each finding
  (a ws_root discriminator), so in a monorepo whose sub-projects share one
  repo_id and one drift.db, one workspace's Stop never mis-resolves a sibling
  workspace's finding. Async-detached correctness findings keep their existing
  one-shot _pending_findings_block delivery and are out of this pass's scope.