bug(adversary): rejects real merge SHAs as placeholder-looking without verification

**Severity:** MEDIUM
**Agent owner:** adversary

## Evidence

switchboard-blue Wave-5 wave-adversarial Pass-2 finding F-W5P2-001 rejected commit SHA `c1c2c3d` in STATE.md decisions-log with a claim that "the SHA looks like a placeholder" (repeated characters + short length). Verification via `gh pr view 35 --json mergeCommit` confirmed it was a real merge SHA (full: `c1c2c3d709433376e9f8b5c89f77d339dbd879af`). The block cost one full adversarial pass to refute.

## Pattern

Any 7-char SHA hex prefix with runs of adjacent identical characters (`c1c2c3d`, `abababc`, etc.) can trip a "looks fake" heuristic. This produces false-positive blocks that waste convergence budget.

## Recommendation

Adversary prompt must include a policy — never dismiss a SHA-looking evidence string as placeholder without first checking `git log --oneline ` or `gh pr view `. If the SHA cannot be verified, downgrade from BLOCK to OBSERVATION and log the verification request rather than gating on it.