feat: audited-decision gate for PIS/COFINS and CFOP_ENTRADA NOT_APPLICABLE/OPERATION_TIME

Missao 2 (fechamento de lacunas fiscais, read-only + UI/engine gated):
- field_contract: pis_cofins_profile now also accepts the literal sentinels
  NOT_APPLICABLE/OPERATION_TIME, resolving to NA only from an audited
  FiscalContextEntry - never inferred from emission statistics. CFOP_ENTRADA
  under an already-decided entry_scope=MIXED_OR_DYNAMIC now resolves to NA
  instead of MANUAL, so it stops blocking product completeness and stops
  re-asking an already-answered question. Regression tests prove: no ADMIN
  decision => unchanged old behavior; decision present => gated bucket, no write.
- context_keys: validate_entry accepts the two sentinels for pis_cofins_profile.
- Contexto Fiscal UI: PIS/COFINS and CFOP_ENTRADA cards show the Bloco 2
  cross-database evidence (5 installations, CRT 1 and 3: emission never reads
  the PIS/COFINS cadastral fields anywhere) and a link to an ADMIN-facing,
  anonymized dossie-for-the-accountant; entry_scope is now a dropdown.
- release/tests: decoupled the Hub's GTI_FISCAL_VERSION from the Agent's own
  version (test_versions_are_coherent_across_hub_and_packages vs the new
  test_agent_version_is_internally_coherent) - a Hub-only release must not
  require touching, rebuilding or republishing the Agent.
- New read-only evidence: docs/runs/GTI_dryrun_universe_summary.json (527
  products, Agent 2's real database), docs/runs/BLOCO2_PIS_COFINS_CROSS_DB_V1.json
  (5 installations), docs/fiscal_completeness_matrix.md, docs/dossie_contador.md
  (internal, real names) + central/static/docs/dossie_contador.md (public,
  anonymized - no CNPJ/razao social/product names), docs/AGENT2_UPGRADE_RUNBOOK_V1.md.
- CLAUDE.md: recorded the permanent fiscal-mission rules (no AI/scraping, no
  Firebird schema changes, deploy only via deploy_hub.ps1, never reenroll,
  no remote access to client Agent hosts, no client data in unauthenticated
  static routes).

No schema/migration change. Zero Firebird writes (new scripts never open a
write connection). Hub only - Agent code untouched.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

tests/test_release_candidate.py

@@ -11,20 +11,34 @@ ROOT = Path(__file__).parents[1]
 sys.path.insert(0, str(ROOT))
 
 
-def test_versions_are_coherent_across_hub_agent_and_packages():
+def test_versions_are_coherent_across_hub_and_packages():
+    """GTI_FISCAL_VERSION is the Hub's own single source (release/VERSION, central/app/version.py,
+    central/pyproject.toml, the manifest). It is deliberately NOT required to match the Agent's own
+    version (see test_agent_version_is_internally_coherent below) - a Hub-only release (Missão 2/3)
+    must be able to bump this without touching, rebuilding or republishing the Agent at all."""
     from central.app.version import GTI_FISCAL_VERSION
     v = (ROOT / "release" / "VERSION").read_text(encoding="utf-8").strip()
-    assert v == GTI_FISCAL_VERSION == "1.3.9"
+    assert v == GTI_FISCAL_VERSION == "1.3.10"
     pep = v.replace("-rc", "rc")
-    for pp in ("central/pyproject.toml", "agent/pyproject.toml"):
-        assert f'version = "{pep}"' in (ROOT / pp).read_text(encoding="utf-8")
-    assert '"AGENT_VERSION", "1.3.9"' in (ROOT / "agent" / "scripts" / "run_agent_service.py").read_text(encoding="utf-8")
+    assert f'version = "{pep}"' in (ROOT / "central" / "pyproject.toml").read_text(encoding="utf-8")
     manifest = ROOT / "release" / "RELEASE_MANIFEST.json"
     if manifest.exists():
         m = json.loads(manifest.read_text(encoding="utf-8"))
         assert m["GTI_FISCAL_VERSION"] == v and m["migrations"]["alembic_head_in_repo"] == m["migrations"]["applied_revision"]
 
 
+def test_agent_version_is_internally_coherent():
+    """The Agent's own version references must agree with EACH OTHER (never guessed, never silently
+    drifting), but are an independent number from the Hub's GTI_FISCAL_VERSION - the Agent is only
+    ever re-versioned when its own code/behavior changes and a new installer is actually built."""
+    agent_pep = (ROOT / "agent" / "pyproject.toml").read_text(encoding="utf-8")
+    m = re.search(r'version = "([^"]+)"', agent_pep)
+    assert m, "agent/pyproject.toml must declare a version"
+    agent_version = m.group(1)
+    assert f'"AGENT_VERSION", "{agent_version}"' in (ROOT / "agent" / "scripts" / "run_agent_service.py").read_text(encoding="utf-8")
+    assert f'AGENT_VERSION_DEFAULT = "{agent_version}"' in (ROOT / "agent" / "src" / "gti_fiscal_agent" / "preflight.py").read_text(encoding="utf-8")
+
+
 def test_manifest_records_the_real_migration_head():
     # The manifest said "0011" while the repository was already at 0018: the
     # generator used the 4-digit file prefix and nothing compared it to Alembic.