One record judge: RecordReadBack, ensure_record and verify_write disagree (correction rule from #1655) #1790

Three parts of the code check the record a save wrote, and each uses its own rules:

• compile_agent.harness.RecordReadBack / record_readback (feat(flow): code as action is the default first-run agent; every save is read back #1542). It reads the system of record for every save in an agent's first run, and stops run 1 on a wrong record, a duplicate, an unreadable read, or no starting read.
• ensure_record.judge (ensure_record: check an ensure-patient write on Medplum through FHIR and its audit trail only #1640, ensure_record: an agent's own correction of the record it created counts as one write #1655). It applies the same rules to FHIR writes: only a record created during the run counts as the named one, a second match is a duplicate, every value must be held, and an unreadable read stops the run.
• The verifier's begin_write / verify_write / recheck() (feat: verified writes for any agent, and taught browser writes with receipts #1589, feat(flow): verified write tools for agent frameworks #1609). It works from a verify.yaml contract, keeps a ledger of writes whose outcome is unknown, and rechecks saves that land late.

The gap. RecordReadBack doesn't have #1655's rule that the agent's own correction of the record it created counts as one write. A first run that saves and then fixes a typo in the same record is judged differently by the two paths. RecordReadBack also has its own late-landing rule, which duplicates recheck().

Proposal:

• Choose one judge, ensure_record.judge generalized beyond FHIR, and have RecordReadBack call it.
• Where compile_first_run gets a verify= contract, judge run 1's saves with begin_write / verify_write, so they get the ledger and recheck. Keep RecordReadBack's read functions only for stores that have no contract.
• Run the e2e tests from feat(flow): code as action is the default first-run agent; every save is read back #1542, ensure_record: check an ensure-patient write on Medplum through FHIR and its audit trail only #1640 and ensure_record: an agent's own correction of the record it created counts as one write #1655 against the single judge, including the correction case.

Fail closed throughout: where the judges disagree, the stricter one wins until the cases are reconciled.