feat: audited-decision gate for PIS/COFINS and CFOP_ENTRADA NOT_APPLICABLE/OPERATION_TIME

Missao 2 (fechamento de lacunas fiscais, read-only + UI/engine gated):
- field_contract: pis_cofins_profile now also accepts the literal sentinels
  NOT_APPLICABLE/OPERATION_TIME, resolving to NA only from an audited
  FiscalContextEntry - never inferred from emission statistics. CFOP_ENTRADA
  under an already-decided entry_scope=MIXED_OR_DYNAMIC now resolves to NA
  instead of MANUAL, so it stops blocking product completeness and stops
  re-asking an already-answered question. Regression tests prove: no ADMIN
  decision => unchanged old behavior; decision present => gated bucket, no write.
- context_keys: validate_entry accepts the two sentinels for pis_cofins_profile.
- Contexto Fiscal UI: PIS/COFINS and CFOP_ENTRADA cards show the Bloco 2
  cross-database evidence (5 installations, CRT 1 and 3: emission never reads
  the PIS/COFINS cadastral fields anywhere) and a link to an ADMIN-facing,
  anonymized dossie-for-the-accountant; entry_scope is now a dropdown.
- release/tests: decoupled the Hub's GTI_FISCAL_VERSION from the Agent's own
  version (test_versions_are_coherent_across_hub_and_packages vs the new
  test_agent_version_is_internally_coherent) - a Hub-only release must not
  require touching, rebuilding or republishing the Agent.
- New read-only evidence: docs/runs/GTI_dryrun_universe_summary.json (527
  products, Agent 2's real database), docs/runs/BLOCO2_PIS_COFINS_CROSS_DB_V1.json
  (5 installations), docs/fiscal_completeness_matrix.md, docs/dossie_contador.md
  (internal, real names) + central/static/docs/dossie_contador.md (public,
  anonymized - no CNPJ/razao social/product names), docs/AGENT2_UPGRADE_RUNBOOK_V1.md.
- CLAUDE.md: recorded the permanent fiscal-mission rules (no AI/scraping, no
  Firebird schema changes, deploy only via deploy_hub.ps1, never reenroll,
  no remote access to client Agent hosts, no client data in unauthenticated
  static routes).

No schema/migration change. Zero Firebird writes (new scripts never open a
write connection). Hub only - Agent code untouched.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

CLAUDE.md

@@ -79,3 +79,33 @@ guarded executor (path allowlist, company-context guard, schema/type/length guar
 
 ## Production deploy rule (Hub)
 Normal deploy = `powershell -ExecutionPolicy Bypass -File .\scripts\deploy_hub.ps1 [-PublishAgent -Version X]` (docs/DEPLOY_HUB.md). Do not recreate ad-hoc deploy scripts (deploy115.py etc.) and do not improvise SSH/docker against 10.0.10.117. The script handles VPN/SSH retry, backup, upload, migrations, rebuild, health, release publish, download verification, and automatic rollback; the real error is in `logs/last_deploy_result.json` and the log.
+
+## Permanent mission rules (fiscal completion missions, recorded 2026-09-28)
+
+- No AI/LLM/embeddings, no paid API, no scraping — every rule/decision is derived from real ERP
+  evidence or an explicit, audited operator/ADMIN decision (`FiscalContextEntry`), never inferred
+  or guessed.
+- No Firebird triggers or schema changes, ever, for any discovery/completion mission. All queries
+  against any Firebird database (client, lab copy, or disposable test DB) are read-only unless the
+  exact path is on an explicit, mission-scoped write allowlist (see above) — writes still go only
+  through the guarded executor.
+- Deploy only via `scripts\deploy_hub.ps1` (see "Production deploy rule" above) — never ad-hoc
+  SSH/docker/psql against 10.0.10.117.
+- If the Agent (agent/) changes in a way that affects its runtime behavior: bump the single-source
+  version, build a new installer, validate it in a fresh Windows Sandbox (install, upgrade in-place,
+  identity preserved), and never overwrite an already-published release. A pure version-label sync
+  bump (release/VERSION, pyproject.toml files, the `AGENT_VERSION` default string) that changes no
+  Agent behavior is not itself an "Agent change" requiring a new installer.
+- Never reenroll an existing installation (never mint a new `installation_id`/token for a machine
+  that already has one) — an in-place upgrade always preserves identity and local SQLite state.
+- No remote-execution channel to any client's Agent host, ever (by design — see
+  `docs/rtc_auto_apply.md`). An Agent version upgrade on a real client machine is always performed
+  by a human operator on-site; the assistant never attempts RDP/WinRM/SSH/PowerShell-remoting into
+  a client host, and never asks for or accepts a production `AGENT_TOKEN`/admin session credential
+  pasted in chat to work around that — live validation of a real installation, when needed, comes
+  from the operator (a panel screenshot, or a value they read and paste themselves).
+- No real client/production data (CNPJ, razão social, product names/descriptions, per-product NCM)
+  is ever published in a location a non-admin can reach (e.g. `central/static/`). Any evidence
+  artifact referenced from a UI card must either be served through an authenticated ADMIN-only
+  route, or be anonymized (generic client labels, no names/documents/descriptions) before being
+  published as a static file.