#2630 gatorwalk-factory: the swamp-extensions process as a gatorwalk lifecycle

Part of the gatorwalk-factory rebuild of @swamp/software-factory (gatorwalk-factory/ in swamp-extensions; GW-1..GW-6 shipped, #2576 through #2611). Read gatorwalk-factory/README.md and DESIGN.md first.

For gatorwalk to run its own issues in this repo, the repo's own process has to exist as a gatorwalk lifecycle. build-swamp-extension (lifecycles/build-swamp-extension.yaml) is the generic tier 1 lifecycle and does not cover it. This is also the rebuild plan's minimum test of the design (question Q18): express swamp's own process in the format.

The process today is @swamp/issue-lifecycle plus agent-constraints/verification-conventions.md: a Lab issue; triage and classification (bug, feature, platform, security; regression analysis); a plan with the repo's planning conventions; adversarial review iterated until no critical or high finding is open; human approval; implementation; a code conformance review with a justification for every deviation; verify-build and verify-reviews at a commit, fixed and re-run until they pass; a person confirming the checklist; attestation posted; PR opened and linked; merge; complete; contributor notification; a session summary.

Scope:

1. On paper first, the cheap check the plan asked for: map every phase, gate and human stop of that process onto the GW-2 format and record what does not fit, before writing the file. Anything the format cannot express is a finding for the format, not something to work around silently.
2. Then lifecycles/swamp-extensions.yaml, with payload schemas for the plan, the adversarial findings, the conformance review and the verification results. verify-build and verify-reviews are swamp workflows, so the verification stage can use workflow mode with their outcomes as evidence.
3. Tests in the style of lifecycles_test.ts: it parses, done is reachable, evidence gates sit on their stages, every CEL expression evaluates, and a run walks the whole process through the real gate evaluator and the work-item methods.

Out of scope: talking to swamp-club (keeping the Lab issue in step, posting the attestation). That is the swamp-club adapter, filed separately. Until it exists the lifecycle records the attestation id as evidence rather than posting it. Nothing is published.