fix(drift): block any gameable-leg edit in the success predicate (WS-2b)

The predicate ignored comparison/SDK/harness-leg edits once any production file also changed, so relaxing sdk-shapes.ts plus one trivial on-target production edit returned resolved:true and auto-merged (the WS-2b hybrid cheat). Now any gameable-leg edit always blocks regardless of production files; schema/*.drift.ts always map to SUPPRESSION_SUSPECTED, other legs to SUPPRESSION_SUSPECTED when paired with a production change and COMPARISON_LEG_ONLY when standalone. Also: dual-classified voice-models.ts blocks (precedence), empty sanctioned-target set fails closed, --changed-file lists are cross-checked against git, the no-post-fix-args legacy PR path is removed (fail-closed), exit 5/1 get distinct reasons over criticalCount, and readReport rejects a missing timestamp.

Author: jpr5