fix: L2 correctness fixes split from loop-engineering (evals, publish gate, guard, env)

[adithya0597]

Summary

Pure bug-fix layer split out of feat/loop-engineering-v3 (per adversarial review: fixes should not be bundled with loop-automation infra). No workflows, no rulesets, no loops/ — those stay on the feature branch (#21/#22).

• tools/publish_gate.sh (P1, security-relevant) — NUL-delimited staged-file loop. The previous for f in $FILES word-split meant a secret inside a filename containing a space exited CLEAN. Functionally re-proven on this branch: a spaced-filename ghp_… token now BLOCKS (exit 1); clean surface stays CLEAN (exit 0).
• 03-evals/src/eval_{corrective,ocr,planner}.py — diagnostics print the resolved Neo4j URI instead of hardcoded bolt://localhost:7688.
• 03-evals/ docs/tests (golden_v1_review.md, golden_v1_draft.py, test_g3.py, h3_instr.py) — stale claims corrected (6 roles → 3 roles; docstring drift).
• tools/run_guard.py — self_test docstring matches ALLOWLIST-exemption behavior (GUARD_SELFTEST_OK).
• 01-context/setup_a2.sh — pin neo4j-graphrag.
• .env.example — correct Neo4j/paperclip facts; add LANGFUSE_HOST / BG_EMBED_MODEL.
• .gitignore — ignore .claude/lessons.md (local working notes).

Verification (run locally on this branch)

• bash -n both shell scripts; ast.parse all 6 Python files — clean
• Functional: temp repo, staged "my secret file.txt" containing a ghp_ token → publish gate: BLOCKED exit 1; negative control → CLEAN exit 0
• python3 tools/run_guard.py --self-test → GUARD_SELFTEST_OK
• bash tools/publish_gate.sh over the staged 12-file surface → CLEAN
• Carried files byte-identical to their feat/loop-engineering-v3 versions (git diff empty)

Merge note

Solo repo: classic branch protection requires 1 approval — merge with gh pr merge --admin (founder). Do not apply the loop-merge-gates ruleset before merging this: it requires publish-gate/pr-classified checks whose workflow files exist only on the feature branch → would deadlock this PR.

🤖 Generated with Claude Code