feat(aidd-orchestrator): run acceptance QA on the final head for criteria the review left unverified #996

Objective / Problem

aidd-orchestrator:01-sdlc's Check zone gives the review $validation_reports, but no zone produces them, and acceptance QA appears nowhere in the orchestration. Since #995, the review names each criterion only a run could prove as unverified at runtime. In the automated flow nothing ever runs those criteria, so a draft PR can ship with a banner, a timing or an outside system's answer that nobody has observed.

Proposed solution

Once the review has cleared and the candidate is final, Check runs acceptance QA on the committed head for the criteria the round left unverified, then re-runs the review so a new round cites the record.

• QA runs after review fixes, never before: a run on an earlier head proves nothing about the reviewed code.
• A failed run reopens Deliver. A run that is blocked or skipped is carried onto the draft PR as a note, never treated as a pass.
• No unverified criterion: QA does not run.

Open questions

• Overlap with feat(framework): add AIDD exploration, task validation and configurable delegation #983's validator (PASS / FAIL / BLOCKED per criterion with evidence). Is the validator the producer of $validation_reports, with browser QA as one of its sources, or are they two producers?
• QA takes its criteria from the spec, never from the plan. How are a plan criterion and a QA scenario matched?