fix(benchmark): attribute private QA diagnostics to questions

[romiluz13]

Summary

Existing private QA capture could not reliably attribute requests to questions or show failures before answer dispatch. Reference #85; this is a diagnostics prerequisite, not an answer-quality fix.

MEMONGO_BENCHMARK_QA_CAPTURE=1
  prepareOfficialQa → scoreOfficialScenario
    request/outcome + questionId (including retries)
    case record + questionId/scenarioId/stage/status

The existing opt-in writer retains private permissions, configured-key redaction and fail-closed writes. Added stage records distinguish retrieval/eligibility failures, invalid completions, transport failures and valid incorrect judgments. Capture-disabled prompts, scoring and call accounting stay unchanged.

Issue acceptance item	Status
Per-question context and failure evidence	Implemented for fresh official and custom-judge runs; legacy custom-v1 excluded
Privacy and default behavior	Tested; captured context can still contain personal data and must remain private
Preference prompt, context preservation and query expansion experiments	Deferred: no causal failure reproduced; current path already passes full text when available, dates and roles
Identical 9-question and 50-question comparisons	Unmeasured: original harness revision, question IDs, retained contexts and exact judge identity are not established
Quality improvement and uncertainty estimates	Unmeasured; no model calls or benchmark-quality claim

Evidence

• Before: the actual prepareOfficialQa → scoreOfficialScenario retrieval-failure regression failed: zero case records instead of the required question-attributed failure.
  After: the regression passes before any answer dispatch; private upstream text is absent from capture.
• Nine added controls exercise both durable protocols, two-question context attribution, incorrect versus unreliable outcomes, private permissions, key redaction and refusal on a case-file collision. Existing retry controls verify every attempt retains its question ID.
• bun run test --concurrency=1: 6,231 passed, 4 skipped, 0 failed. The first ordinary-concurrency run failed an unchanged 50 ms engine readiness test; that test passed in isolation and in the complete serial-package run. No assertion or engine change was made.
• A fresh CI=true bun run test --concurrency=1 --force also passed with zero Turbo cache hits; all nine JUnit reports and the API conformance suite passed the skip-green guard.
• bun run check-types, explicit strict TypeScript checking of the changed scorer/helper/new test, bun run lint, bun run build, and bun run check-publishability --artifacts-only: passed. Build outputs may use Turbo cache. Artifacts mode excludes unpublished-version validation; no version change is included.

The pinned upstream evaluator defines the official judge; a custom judge is not an official score. AutoMem #158 is related research, not evidence of the same cause here.

Merge Danger

Door: two-way

The change can be reverted without migrating stored memory. An opted-in capture write failure deliberately stops QA; a prior provider call may already have incurred a charge. Raw diagnostic captures must not be committed or attached publicly.

Blast Radius: benchmark

This draft leaves #85 open. Comparable evaluation remains pending; no merge or publication is requested.