chore(pin): consume core-candidate-2026.08.05.2 with ToolSpec and effect verification

[darklordVirtual]

The REMORA surface this product plan (§12) depends on is now complete in the pinned core, so the pin moves from core-candidate-2026.08.05 to core-candidate-2026.08.05.2 (716f6bd, built from a clean checkout).

Verified before pinning, not after

python scripts/verify_core_pin.py --out dist    # pin verified: 6 artifacts, all hashes match
python -m pytest tests/compatibility -q         # 43 passed

The compatibility suite ran against the wheel installed from the verified assets, not from a convenient local copy.

What the pin now covers

tool_spec_v1.yaml and postcondition_contract_v1.yaml join the wheel, OpenAPI export, SDK snapshot and lifecycle schema. Agreeing with core about the code while disagreeing about what a ToolSpec is, or what an effect status means, is exactly the drift a pin exists to prevent.

The absence test did its job

test_effect_verification_is_honestly_absent existed so the FT-04 gap could not drift into place unnoticed. It fired, and it is replaced by positive contract tests rather than deleted — these are the properties this product's incident handling relies on, so a future core that changed them must fail here:

• the five effect statuses, exactly
• EFFECT_UNOBSERVABLE and EFFECT_VERIFIER_FAILED are not terminal — if core made them terminal, this product would start closing incidents that are still open
• comparison covers the declared delta only — otherwise every concurrent write by another legitimate writer would surface as a mismatch and the signal would become noise
• an unreadable object is never reported as a mismatch, so the product never compensates on a failure to look

record_effect is now required on both clients: sync/async drift would force callers into a per-client branch the product plan forbids.

Still a prerelease

No external review has run against this build and Gate B is not closed. And effect verification only covers tools that declare a postcondition reader — a tool without one reports EFFECT_UNSUPPORTED, recorded so the absence is visible rather than assumed away. The README states both.