Apply B1+B2+B3+B4 from 2026-04-30 cross-lineage scrum

Cross-lineage scrum (Opus 4.7 / Kimi K2.6 / Qwen3-coder via chatd's
/v1/chat) on the harness's first 4 commits surfaced 5 real bugs;
this commit lands the 4 inside the LLM/validator stack. B5 (scanner
skip-list semantics) ships separately as it changes scan behavior
on every target repo.

B1 (Kimi BLOCK + Opus WARN convergent) — internal/validators:
evidencePresent had two flaws: (1) cursor advanced on match in the
trim-line fallback, breaking same-line repeated matches AND skipping
not-yet-considered lines so out-of-order evidence spuriously failed;
(2) strings.Contains on a single `}` trim-matched any closing brace
in the file, defeating the "evidence quotes real text" contract.
Fix: trivial-evidence guard FIRST (reject anything <4 non-whitespace
chars) + per-line search no longer advances a cursor. New regression
test TestEvidencePresent_RejectsTrivialMatches covers `}`, `{`, `)`,
empty, and out-of-order multi-line evidence (which now passes —
order isn't part of the contract).

B2 (Kimi WARN + Opus WARN convergent) — internal/pipeline:
WriteJSON error for rejected-findings.json was swallowed with
`if err == nil`, so a write failure left the validation phase
reporting status="ok" while the audit trail vanished. Mirror the
validated-findings branch: surface the error in
validatePhase.Errors + bump status to degraded + ExitCode=66.

B3 (Kimi BLOCK + Opus BLOCK convergent) — internal/llm/ollama.go:
HealthCheck.basic_prompt_ok was set to true on ANY non-empty
response, so a model emitting `<think>...` traces or apologies
passed silently. Now requires the response to contain "OK"
(uppercase, substring). Substring rather than equality lets minor
whitespace/punctuation variations through (some models add a
trailing period). Errors now record what the model actually said
when it fails the check.

B4 (Opus BLOCK only — same class as today's chatd Anthropic-temp
fix) — internal/llm/ollama.go: chatBody had `if opts.Temperature != 0`
which silently dropped Temperature=0 from the request, so HealthCheck
+ Reviewer (both pass Temperature=0 expecting determinism) actually
ran at Ollama's ~0.8 default. Always forward Temperature now. The
two callers always set explicit values, so "0 means 0" is correct;
if a future caller wants Ollama's default they'll switch
CompleteOptions.Temperature to *float64 like chatd did this morning.

Verified end-to-end: insecure-repo + --enable-llm still produces 25
confirmed findings (16 static + 9 LLM), 0 rejected. Validator unit
tests: 11 pass (added TestEvidencePresent_RejectsTrivialMatches).

Same-day-as-shipping scrum, same-day-as-shipping fixes. The
convergent-≥2 gate caught 3 of these; the 4th was Opus-only but
verified by reading the code (same idiom as today's chatd bug).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/validators/validate_test.go

@@ -184,6 +184,38 @@ func TestValidate_AcceptsRelativeRepoPath(t *testing.T) {
 	}
 }
 
+// TestEvidencePresent_RejectsTrivialMatches locks in scrum fix B1.
+// Pre-fix, evidence "}" or "{" trim-matched almost any line in the
+// file via strings.Contains, so an LLM emitting a single brace would
+// pass validation against any file with braces.
+func TestEvidencePresent_RejectsTrivialMatches(t *testing.T) {
+	content := "package main\nfunc main() {\n\tfmt.Println(\"hi\")\n}\n"
+	cases := []struct {
+		evidence string
+		want     bool
+	}{
+		// Verbatim full content matches
+		{"func main() {", true},
+		{"fmt.Println(\"hi\")", true},
+		// Trivial single-char/-line matches must REJECT
+		{"}", false},
+		{"{", false},
+		{")", false},
+		// Empty evidence is rejected (caller-side enforced too)
+		{"", false},
+		// Multi-line evidence in different order — must still pass
+		// (cursor-reset fix B1 — pre-fix this would fail because the
+		// cursor advanced past the first match)
+		{"fmt.Println(\"hi\")\nfunc main() {", true},
+	}
+	for _, c := range cases {
+		got := evidencePresent(content, c.evidence)
+		if got != c.want {
+			t.Errorf("evidencePresent(%q) = %v; want %v", c.evidence, got, c.want)
+		}
+	}
+}
+
 // === Path-traversal protection: hallucinated "../../../etc/passwd" must reject ===
 
 func TestValidate_RejectsPathEscapingRepo(t *testing.T) {