fix(capsule-pipeline): guard escalation choices by canonical key

[Brian Krabach (bkrabach)]

Summary

Part of dot-runner #78. After the canonical human-choice metadata fix landed in dot-runner PR95 (85ad35a1341022fcfe6e39b188338d29b9a7df9c, with E 0bb8bfdf8b726e0633553c8196dbd5525fd9268c as an ancestor), guard the capsule escalation edges by the native human-gate result.

For unattended escalation, a failed or unanswered gate has no eligible escalation edge instead of choosing Abandon. For a successful gate, each existing edge is selected only when context.human.gate.selected matches its canonical key: A, C, or K. The eight native per-key conditions preserve every original option, prompt/label, target, and ordering. This is source-owned graph guarding, not a new engine extension.

The freeform path and engine/core contracts are unchanged. This PR changes only the three capsule DOT graphs and a static guard test; no engine, core, frozen contract, dependency, or platform source is changed.

Verification checklist

• nlspec evidence: the holistic pinned StrongDM attractor spec §4.6 was read, including choice derivation, handler-owned selected key/label, edge-condition priority, and unmatched-edge behavior; this change consumes the canonical result and does not extend the engine
• Source suite: 256 passed, 7 skipped — five optional Google E2E cases and two namespaced framework-reference cases
• Independent combined normal-installed DTU verification: 36 controls passed — 16 interactive, 12 guarded headless, 6 baseline, and 2 locked controls
• Static guard covers all eight native per-key conditions across the three graphs
• Diff is limited to the three DOT graphs and the static guard test
• No new public content class is introduced; pre-publication leak review is N/A
• PR body includes bounded verification evidence and limitations

Verification evidence

• Exact source HEAD: e6d14fdca3d2548ee8d793a89d375134a6ad6646.
• Exact engine dependency E: 0bb8bfdf8b726e0633553c8196dbd5525fd9268c, now merged in dot-runner PR95 at 85ad35a1341022fcfe6e39b188338d29b9a7df9c.
• The independent evidence covered the normal installed combined runtime and the 36 native controls listed above.
• The evidence was bounded to the changed graph/static-guard scope and used no LLM or paid model. It does not claim whole-production completion or a full pipeline run.
• No raw logs, private host paths, or test-configuration secrets are included.

Scope and limitations

Source S depends on the now-merged engine metadata behavior from PR95, but this PR owns only the graph conditions and their static coverage. It does not alter engine dispatch, choice options, prompts, targets, status vocabulary, freeform behavior, or any frozen contract.

This remains PART OF #78. It intentionally does not use Fixes or Closes; follow-up work and parent review remain open and are not closed automatically.

Notes for reviewers

The repository's AGENTS.md and PR template were reviewed. Required commit trailers and original authorship are preserved. This is publication of source S only; port P remains unpublished. Resolver PR148 is unrelated and untouched.