[superseded by #54] fix: observe outer Code Mode execute evidence

[bateau84]

Superseded by #54 after #52 merged into the target branch. #54 is based on the post-#52 head and contains only the final-review defect fix.

Purpose

Correct the blocking outer-execute evidence gap found during the independent final review of #45.

Defect

Stock OpenCode 2.0.23 creates the model-facing Code Mode execute tool inside Tool.snapshot, after registration transforms have run. The production observer therefore did not emit a native observation for that real outer invocation. Inner records were linked only to an internal native-outer-unobserved:... token.

That allowed the public native boundary to remain complete with zero outer-execute observations even when Code Mode really ran.

Correction

• Observe the real model-facing outer execute invocation at stock execute.before.
• Keep Session-owned session.tool.success / session.tool.failed as its terminal authority.
• Bind inner Code Mode records to that observed outer invocation ID.
• Reject dangling, wrong-tool, or identity-mismatched Code Mode parents in canonical evidence accounting/validation.
• Add provider-free acceptance checks for:
  • observed outer execute;
  • exact parent ID resolution;
  • Session/message/actor/CallID agreement;
  • native coverage that cannot falsely report zero during Code Mode;
  • concurrent reverse-completion calls sharing the same observed outer parent.
• Document that the synthetic outer execute input is observed exactly at execute.before, before CodeMode.Input decode. Registered direct tools remain observed after decode.

Scope

No threat-model expansion. No OpenCode patch/fork, protected channel, signing, broker, process isolation, or hostile-plugin machinery.

Targets refactor/trusted-checkout-evidence.