feat(aidd-orchestrator): gate draft pull requests with independent QA evidence #909

Problem

aidd-qa now provides implementation-independent browser acceptance QA, but aidd-orchestrator:01-sdlc does not invoke it. The current SDLC validates, reviews, challenges, and opens a draft pull request without publishing acceptance evidence.

A reviewer therefore cannot tell from the pull request whether the reviewed commit passed technical validation and independent acceptance QA, failed it, was blocked, or had no supported acceptance interface.

Outcome

A draft pull request exposes a complete, commit-bound evidence set: technical validation, independent review, acceptance QA when applicable, and an explicit reason when QA is skipped or blocked.

Flow

1. Deliver runs technical validation and commits the candidate.
2. Check independently reviews and challenges that exact commit.
3. The SDLC opens a draft pull request and publishes the technical validation summary.
4. It discovers the installed QA capability and gives it only the acceptance criteria plus the reviewed candidate.
5. QA runs against that exact commit and publishes qa.md plus evidence links.
6. The pull request records one evidence state: passed, failed, blocked, or skipped with a reason.
7. Any new candidate commit invalidates prior review and QA evidence and re-enters the appropriate checks.

Acceptance criteria

• The draft pull request identifies the exact reviewed commit.
• It contains the technical test and coverage summary produced by the technical-test capability.
• The orchestrator discovers QA by capability instead of hardcoding a plugin address.
• QA receives acceptance criteria and the reviewed candidate without implementation instructions.
• Browser-observable criteria produce a validated qa.md and linked videos.
• A QA failed or blocked state remains explicit and never becomes successful evidence.
• An unsupported interface produces a justified skipped state rather than false success.
• A commit change invalidates stale review and QA evidence.
• The SDLC neither merges nor automatically promotes the pull request out of draft.

Prior art

• feat(aidd-qa): create an implementation-independent QA plugin #908 and PR feat(aidd-qa): create an implementation-independent QA plugin #917 delivered aidd-qa.
• refactor(aidd-dev): reserve test for automated technical tests #907 owns the technical test and coverage summary contract.

Out of scope

• Implementing QA domain logic inside the orchestrator.
• Automatic merge or automatic promotion out of draft.
• Creating technical tests inside the QA plugin.
• API or CLI acceptance interfaces.