feat: add durable issue development loop

[codeacme17]

Summary

Adds a first-class, auditable issue-dev-loop for continuously turning eligible Echo UI issues into verified pull requests while preserving codeacme17 as the only reviewer/merger.

What is included

• loops/issue-dev-loop/ contract, compact state, append-only logs, exact screen-shots/ evidence layout, combo trigger, and evolve policy
• explicit $implement handoff and attestation gates for every product-code change
• isolated fresh-context PR reviewer plus executor response/adjudication protocol
• per-review-round GitHub author, head SHA, content, and review→repair→reply timestamp verification
• exact-head GitHub Actions evidence artifacts and UI screenshot provenance
• durable GitHub state journal in issue [Loop] issue-dev-loop state journal #105 for active checkpoints and terminal records, including fresh-worktree resume
• blocking owner notifications with verified RESUME <run-id> responses
• owner-only approval/merge observation; no agent merge, auto-merge, or branch-protection bypass
• evolve requests after 5–10 runs or repeated failure patterns

Safety and activation

This PR is intentionally a draft and targets dev. It must be reviewed and merged by @codeacme17.

Before unattended activation, configure distinct executor and reviewer GitHub bot/App identities in loops/_shared/owner-channel/channel.json. Both values are intentionally left null; neither identity may be codeacme17 or have merge authority. The durable journal is already configured to issue #105.

Verification

• pnpm verify
• issue-loop runtime tests: 32/32 passed
• structural validation: 47 files checked
• lint and all typechecks passed
• React 18/19, Tone 15 browser, Tailwind 3/4 packed-consumer smoke passed
• example and docs production builds passed
• bilingual Nextra route smoke and UI contract passed

Independent review history

The loop runtime was independently reviewed in fresh contexts before and after draft publication. Review findings were resolved with mandatory durable checkpoints, canonical remote-state proof, restored checkpoint attestations, identity separation, complete $implement attestations, exact-head evidence, review-comment completeness, digest-bound screenshots and commands, visible PR proof, branch-bound resume validation, and remote owner-merge rechecks. The final Standards + Spec closure review passed with zero actionable findings against exact head e584cafa46d1e7b365f5f77a0c639fd72bca949c.