evals: capability-policy dataset for the exact capability layer

[semantic-debt]

The existing frozen benchmark carries no trusted, predeclared exact capabilities, so it cannot measure the known-benign capability matcher. This adds an offline synthetic corpus and runner for that layer, together with fail-closed grant validity checks.

Behavior and scope

• Add 1,080 deterministic cases in 90 families across ten primitives: 936 public cases and 144 held-out cases. Every family contains one authorized base action and eleven counterfactuals. Splitting by family keeps counterfactual siblings together.
• Honor optional not_before and revoked_at fields. A grant that has not started, has been revoked, or has an invalid timestamp cannot match. UTC conversion outside Python's supported datetime range returns a non-match instead of raising an exception.
• Preserve LF bytes for the public corpus through Git attributes, including checkouts with core.autocrlf=true, so its frozen SHA256 is portable across Linux and Windows.
• Make the generator's --check validate the public file and both splits' manifest hashes, counts, label counts, paths, publication flags, and total family count. Verification regenerates in memory and never writes or scores held-out cases. Remove the always-true family-count assertion.
• Keep dataset labels separate from authorization: grants are synthetic fixtures and never become runtime policy. A non-match falls through to the remaining gate layers.

The public corpus and manifest retain their original bytes and hashes. The documentation describes the stronger check command and the dataset's limits.

Regression coverage

• Exercise Git's real checkout filtering with core.autocrlf=true and verify the pinned corpus hash.
• Reject corrupt public/private hashes, counts, label counts, paths, publication flags, total family counts, and invalid manifest JSON. Check mode preserves the input manifest.
• Reject UTC-overflow dates in both not_before and expires_at; retain correct inclusive start and exclusive expiry boundaries with non-UTC offsets.

The added regressions produced 19 failures before the fixes. The final focused suite passes 43 tests.

Validation

Validated commit: 47f5fd926416c45ca52e41c5d3e80da0769c4f7b, including the current main and the Windows scratch-path correction.

• Local Windows / Python 3.13.7: python -m pytest -q tests — 3,280 passed, 12 skipped.
• Full Linux/Windows matrix — all six jobs passed on Python 3.10, 3.12, and 3.13. Python 3.10: 3,279 passed, 13 skipped per OS; Python 3.12/3.13: 3,280 passed, 12 skipped per OS.
• Normal PR CI — passed.
• python -m pytest -q integrations/gemini-cli-shadow/tests -p no:cacheprovider — 54 passed, locally and in each matrix job.
• python -m pip wheel . --no-deps -w wheelhouse — built successfully. Clean wheel-install tests with SEMGATE_WHEEL_DIR=wheelhouse — 2 passed, locally and in each matrix job.
• Offline injection, trace-drift, and scripted chat-approval evaluations passed the workflow assertions, including zero automatic injection allows, zero false chat approvals, and zero chat code-path failures.
• Public capability runner — 936 cases, 78/78 base cases matched, zero false allows, zero unnecessary asks.
• Generator --check confirms the public corpus and both splits' manifest metadata match regeneration.
• git diff --check origin/main HEAD passed.

All model evaluations in this slice use offline providers; there are no paid model calls.