test(research): lock shared-evidence consumption

[stacknil]

Summary

• expose overlapping search membership in the focused candidate control
• prove materialized event IDs obey single-consumption
• add a negative validator regression for selected episode evidence reuse and document the candidate-v1 boundary

Why

The research ADR still listed shared evidence as an open control. The implementation already rejected selected episodes that reused event evidence, but the contract lacked direct positive and negative regression evidence. These focused tests provide that evidence without expanding the JSON fixture surface.

Validation

• python -m unittest tests.test_episode_candidate_core tests.test_episode_candidate_validation
• python -m unittest discover -s tests -p 'test_episode*.py'
• python -m ruff check scripts tests
• cmake --build build --config Debug
• ctest --test-dir build -C Debug --output-on-failure
• mutation check: disabling the reuse guard makes the focused validator test fail; restoring it passes
• gitleaks git --no-banner --redact --log-opts='origin/main..HEAD' .
• git diff --check origin/main...HEAD

Review contract

• Design decision: search candidate membership may be many-to-many; candidate-v1 publication requires disjoint event-ID sets among selected episodes. Time cooldown remains a separate, stronger compatibility rule.
• Main risk: overgeneralizing this within-segment candidate-v1 invariant into a cross-rule or production evidence policy.
• Compatibility impact: tests and ADR only; Detector::analyze(), CLI behavior, report-v3, and v0.6 behavior are unchanged.
• Rollback path: revert 4f259fa and 3182768.

[stacknil]

Post-CI final review complete.

• Checks: all 11 reported runs passed (Ubuntu, Windows, parser fuzz smoke, Repo Sentinel, and CodeQL).
• Design decision: search membership may be many-to-many, while candidate-v1 publication requires disjoint selected event-ID sets; cooldown compatibility remains a separate stronger rule.
• Main risk: this bounded within-segment oracle invariant could be mistaken for a cross-rule or production policy.
• Compatibility impact: tests and ADR only; no diff under src/, include/, or CMakeLists.txt; Detector::analyze(), CLI, report-v3, and v0.6 behavior remain unchanged.
• Rollback path: revert 4f259fa and 3182768.
• Review evidence: branch is 0 behind / 2 ahead of origin/main, merge state is clean, final git diff --check passed, focused mutation check proved the reuse guard is test-observable, and Gitleaks/privacy scans found no secrets or private identifiers.
• Reviews/comments: no bot or reviewer action items.