Bind a manual sign-off to the tree it was given against

F63, found live on run 19. A manual check on these projects is a human
reading what the code prints. RecordPlanPhaseVerification asked only
whether a sign-off for that plan and phase existed, and one exists forever,
so rerunning a phase's automated checks at a new commit carried the human
half along with it. The rig proved it twice: two operator commits and two
re-verification requests, each coming back verified without anyone looking.

The reducer now records which tree the human confirmed, the record carries
it forward as provenance, and a run whose commit does not match it waits
for the human again. A sign-off given before any run has no confirmed tree
and still counts, so the ordinary ordering is unchanged.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CVbaKucEYBjMqVeUgJUsc1

README.md

@@ -0,0 +1,17 @@
+# orchestra ui mockups
+
+`final/` contains the nine accepted/current screen directions:
+
+1. dashboard
+2. task detail
+3. terminal live pane
+4. tasks
+5. decisions
+6. workers
+7. projects
+8. review
+9. settings
+
+`iterations/` contains every generated mockup from the design session, including superseded variants.
+
+`orchestra-ui-spec.md` is the accompanying implementation/design specification.