feat(evals): per-case pass rates with Wilson intervals, identity series and quarantine policy

scripts/eval-flake-rank.ts becomes eval:pass-rates (eval:flake-rank stays an
alias, and the legacy aggregate stays exported). It reads eval-store's
trial-outcomes JSONL from the last N completed evals-periodic runs on this
branch and main (gh, downloading only the trial-outcomes artifact, cached and
size-capped, parsed as data), plus local eval dirs, and prints per-case
per-trial pass rates with 95% Wilson intervals.

A series is a case's own touchfiles minus GLOBAL_TOUCHFILES
(caseSeriesIdentities, for the report job to stamp), per model, CLI version
and policy version. Labels: INCONCLUSIVE, BROKEN, FLAKY, FAILING, PASSING.
--backfill imports legacy slice artifacts as pre-policy trials (first
attempt only, attributed by registry id, never guessed) for display only.

--gate fails with ACTION REQUIRED on post-policy evidence only: drift below
the quarantine entry rule, a rule case behaving like behavior, a one-sided
Fisher drop against the previous identity (Holm-controlled), and quarantine
entries that met their exit rule, expired after 8 weekly runs, broke the
10% tier cap or are invalid. CASE_QUARANTINE entries now carry a
failureClass (detector, harness or model-latency); a product defect has no
class and is never quarantined. The policy test pins EVAL_POLICY's approved
constants.

test/helpers/periodic-exclude-data.ts

@@ -106,14 +106,18 @@ export const EVAL_POLICY = {
  * failures (a product defect is never quarantined), and unchanged case
  * touchfiles in the change that adds it. Pinned by
  * test/periodic-exclude-policy.test.ts.
- *   reason    - the written diagnosis
- *   tracking  - issue or TODOS pointer
- *   owner     - who removes it
- *   enteredAt - ISO date the entry landed (expiry counts weekly runs from here)
- *   exit      - the measurable exit condition
+ *   reason       - the written diagnosis, with the pass-rate evidence
+ *   failureClass - what the diagnosis found; a product defect has no class here
+ *   tracking     - issue or TODOS pointer
+ *   owner        - who removes it
+ *   enteredAt    - YYYY-MM-DD the entry landed (expiry counts weekly runs from here)
+ *   exit         - the measurable exit condition
+ * At most EVAL_POLICY.quarantine.capFraction of a tier's cases (gate and
+ * periodic are the blocking tiers) may be quarantined at once.
  */
 export const CASE_QUARANTINE: Record<string, {
   reason: string;
+  failureClass: 'detector' | 'harness' | 'model-latency';
   tracking: string;
   owner: string;
   enteredAt: string;