Runtime: evaluate conditional app state-machine transitions

[enricopiovesan]

Summary

Implement runtime evaluation for conditional app state-machine transitions approved in spec 053-conditional-state-transitions.

The merged #544 slice added the approved spec and manifest schema validation for transition condition objects. Runtime session execution still needs to evaluate those conditions against capability output before apps such as doc-approval can branch safely.

Governing Spec

• 053-conditional-state-transitions
• 052-app-state-machine

Required behavior

• Evaluate transitions with the same on event in manifest order.
• The first matching condition wins.
• Unconditional transitions are fallback transitions and are evaluated after conditional transitions for the same on event.
• If no condition matches capability_succeeded, emit a structured no_matching_transition error event and leave the session state unchanged.
• If condition evaluation sees an incompatible type, emit condition_type_error and leave the session state unchanged.

Definition of Done

• Runtime condition evaluator supports eq, neq, gt, gte, lt, lte, in, and exists.
• Evaluation reads dot paths rooted at output from the capability result.
• Runtime execution preserves deterministic first-match semantics.
• Error events for no_matching_transition and condition_type_error are documented and tested.
• Integration test covers confidence 0.90 -> auto_approved and 0.70 -> pending_review.
• bash scripts/ci/rust_checks.sh passes.
• bash scripts/ci/spec_alignment_check.sh passes with governing spec 053-conditional-state-transitions.
• bash scripts/ci/coverage_gate.sh passes.

Blocks

• Add doc-approval.extract capability contract, WASM agent, and app manifest #538