feat(model-grounded-detection): group 6, the execution tier as a seam not a build

The rung this project deliberately does not build. Clearwing already runs
sandbox lifecycles, container pools, sanitizer images, PoC replay and stability
classification, and the corrective brief concluded -- from this project's own
defect history -- that reimplementing that machinery is where we go wrong. So
model/execution.py decides eligibility, calls an adopted tool, and records what
happened. A test asserts structurally that it imports no container or
subprocess machinery and defines no build/run/compile/patch function, because
the failure mode to prevent is this file quietly growing a sandbox.

Eligibility is narrow in both directions: only a family a static model cannot
arbitrate (memory safety in C, where the bug turns on runtime layout -- Req
10.3 forbids any web/logic family depending on this tier, and each now has
taint, dominance or constant abstraction instead), and only a finding the model
left undecided. The tier escalates uncertainty; it never re-checks a verdict.

One deliberate asymmetry: a failure to reproduce is NOT a refutation. A sandbox
that does not trigger a bug has not shown the bug is absent, only that this
attempt did not trigger it, so the candidate stays where the model left it.
Reading a failed reproduction as a clean bill of health is the same error class
as reading an absent engine as "no vulnerability".

With no adopted tool present -- the normal case -- the rung is never reached and
clearwing_unavailable is recorded.

All 16 tasks of model-grounded-detection are now done. 720 passing, mypy/ruff
clean, gates byte-identical, zero orphaned modules.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG

benchmarks/measurements/2026-09-08-module-audit.json

@@ -1,13 +1,13 @@
 {
   "counts": {
-    "load_bearing": 84,
+    "load_bearing": 85,
     "standalone_capability": 7
   },
-  "generated": "2026-09-08 (regenerated after group 5: calibration and reporting)",
+  "generated": "2026-09-08 (regenerated after group 6: the deferred execution tier)",
   "kept_with_a_lever_stripped": {
     "improve/evolve.py + improve/validator.py": "the design's Removed list named these whole, but each is a mix: the mechanism lever (removed) and the deterministic rule-status improve loop that `ousast improve` still runs from benchmark evidence, which has no LLM in it and is not what this feature supersedes. Deleting the files would have taken a retained capability with them."
   },
-  "modules": 91,
+  "modules": 92,
   "note": "Classification of every source module after the group-1 subtraction. load_bearing = reachable from a gate, the CLI, or named by a surviving requirement; standalone_capability = its own entry point or protocol, deliberately off the scan path; orphaned = no importer, no entry point, no surviving requirement -- removed, never carried.",
   "orphaned": [],
   "removed_in_this_pass": {
@@ -331,6 +331,7 @@
         "model.candidates",
         "model.config_value",
         "model.dominance",
+        "model.execution",
         "model.judge",
         "model.specs",
         "model.taint"
@@ -376,6 +377,12 @@
       "module": "model.endpoint",
       "reason": "model-grounded-detection Req 8: the judge client, wired by model/judge.py in group 3"
     },
+    {
+      "classification": "load_bearing",
+      "importers": [],
+      "module": "model.execution",
+      "reason": "model-grounded-detection Req 10: the deferred execution tier seam, adopted not built"
+    },
     {
       "classification": "load_bearing",
       "importers": [],
@@ -387,6 +394,7 @@
       "importers": [
         "model.config_value",
         "model.dominance",
+        "model.execution",
         "model.judge",
         "model.taint"
       ],