enhancement(governance): introduce process-gap codification ledger to enforce S-7.02 cycle-closing checklist

## Summary

Across the ftc-blue Phase 1d cycle, 14 new lints were added in response to 9 adversarial passes. Each new lint targeted a drift class the adversary had identified — empirically, every drift class that got a lint stopped recurring in subsequent passes. The lints work.

But there's no formal tracking of which adversary findings became lints versus which were merely fixed in-place. The factory has an S-7.02 cycle-closing-checklist rule that says process-gap findings must be either codified into a lint or recorded as justified deferrals — but enforcement is manual and easy to miss.

Recurring drift classes observed during the cycle (caught multiple passes before codification):

- ARCH-INDEX ADR row version pairing — 3 recurrences before `lint-adr-index-version-sync` added in pass-8.
- ADR-0006 markdown ↔ YAML changelog drift — 2 recurrences before `lint-changelog-dual-store-sync` added in pass-8.
- DI-NNN namespace propagation — 3 recurrences before `lint-di-namespace-owner` added in pass-8.
- Save-schema consumer drift — 3 recurrences before deny-list extension in pass-9.
- OQ-NNN namespace collision — 2 recurrences before `lint-id-namespace-collision` added in pass-9.

Each recurrence cost a full remediation burst (≈300–700k tokens). Earlier codification would have saved several million tokens across this single cycle.

## Proposed change

Introduce a "process-gap codification ledger" at `.factory/process-gap-ledger.md` (or similar canonical path) with the following structure per entry:

```
| ID | Drift class | First seen | Codified | Lint name | Recurrences before codify |
|----|-------------|------------|----------|-----------|----------------------------|
| PG-001 | ADR row version pairing | pass-5 M-1 | pass-8 | lint-adr-index-version-sync | 3 |
```

The orchestrator's S-7.02 cycle-closing-checklist enforcement gets a concrete artifact to check: every adversary `[process-gap]` finding must either appear as a row in the ledger with a `Codified` column, OR have a corresponding justified-deferral entry in STATE.md.

The ledger is also a useful retrospective signal: "we let this drift class recur 3 times before codifying" is a process-improvement opportunity that's invisible without the ledger.

## Applies to

- New file: `.factory/process-gap-ledger.md` (or templated under `templates/`)
- `agents/orchestrator/` — S-7.02 enforcement consults the ledger
- `agents/adversary.md` — emit `[process-gap]` findings with structured metadata that maps to a ledger entry
- `skills/run-phase/SKILL.md` — phase-close step validates ledger coverage
- `agents/session-reviewer.md` — captures recurrence patterns into the ledger

## Acceptance criteria

- [ ] Canonical ledger file format defined
- [ ] Phase-close gate validates every `[process-gap]` adversary finding has a ledger row or deferral
- [ ] Ledger is consulted by session-reviewer for retrospective analytics
- [ ] Documented example workflow: adversary finds gap → ledger entry added → lint commissioned → recurrence stopped

## Found during

ftc-blue Phase 1d adversarial cycle (2026-06-23, vsdd-factory@1.0.0-rc.21). Cumulative: 14 lints added in response to ~10 recurring drift classes; estimated savings of 3M+ tokens if codification had been faster.

## Notes

The S-7.02 rule exists in policy form but lacks a mechanical artifact to attach to. The ledger fills that gap.