fix(qa-evidence,observer): reject placeholder metadata and replay-only learning; declare the docs atomic-write target

- materialize measures revision, runtime and cwd itself and rejects supplied
  values that differ (CI run wrote revision "HEAD" and runtime "bun"), and
  refuses learning checkpoints that replay the same probe, naming the fix.
- The docs write observer treats Claude Code's atomic temp for the authorized
  doc target as transient, so a temp renamed before its per-file watch no
  longer marks the observation incomplete (ship-docsync-completion flake).
  Per-file monitoring outside declared targets stays fail-closed.

test/qa-caller-report-observer.test.ts

@@ -14,11 +14,11 @@ function fixture() {
   return root;
 }
 
-async function atomicPublication(directory: string, declared?: string) {
+async function atomicPublication(directory: string, declared?: string, atomicTargets?: string[]) {
   const root = fixture();
   const temporary = path.join(root, directory, 'exploration-004.json.tmp.2644.340bb6ad0afe');
   const target = path.join(root, directory, 'exploration-004.json');
-  const observer = await observeQAWrites(root, { reportDirectory: declared });
+  const observer = await observeQAWrites(root, { reportDirectory: declared, atomicTargets });
   const stat = fs.lstatSync;
   let renamedAtWatch = false;
   let stopped = false;
@@ -75,6 +75,14 @@ async function atomicPublication(directory: string, declared?: string) {
     });
   }
 
+  test('an authorized atomic target outside the report directory publishes without the per-file watch race', async () => {
+    const result = await atomicPublication('foreign/reports', undefined, ['foreign/reports/exploration-004.json']);
+    expect(result.renamedAtWatch).toBe(false);
+    expect(result.observation.failures).toEqual([]);
+    expect(result.observation.complete).toBe(true);
+    expect(result.observation.events).toContainEqual(expect.objectContaining({ path: result.target, mask: 0x80 }));
+  });
+
   test('supports an explicitly selected nested report directory, not an implicit reports name', async () => {
     const result = await atomicPublication('foreign/reports', 'foreign/reports');
     expect(result.observation.complete).toBe(true);