Iteration_4: expand task bank 20→30, add variants for all tasks, fix baseline policy for chain-gated CRIT tasks

feat: investigation required for full credit on hard/critical + replay seed support

fix: thread-safe sessions, meaningful jitter, remove investigation_hints giveaway

fix: WebSocket /ws HTTP upgrade probe for Starlette >= 0.36

fix: SSL cert verification and J-05 pattern in run_tests.sh

fix: correct reward constants and test suite issues

Initial Commit