feat(campaign): preflightModels/assertModelsServed + building-doctrine doc

[drewstone]

What

The PRE-hoc complement to assertRealBackend. That guard inspects RunRecord[] after a run to catch a stub/unconfigured backend; this verifies the campaign's models are actually served by the router before spending tokens, so a dead default surfaces as a config error rather than a silent stub run.

Part 1 — preflightModels / assertModelsServed (src/integrity/preflight.ts)

Colocated with assertRealBackend in src/integrity/, exported from the same root-barrel tier.

• preflightModels({ baseUrl, apiKey, models, probe?, fetchImpl? }) → { succeeded, value: ModelPreflight[] | null, error }.
  • Membership (free): one GET {baseUrl}/models; listed = id is in the served set.
  • Probe (opt-in, spends ~1 token/model): POST {baseUrl}/chat/completions with a 1-message, max_tokens: 5 request; served = 2xx, status = HTTP status, detail = the body's error.message (e.g. No API key configured for model ...). served is null when not probed; probe defaults to false.
  • Typed outcome — never throws on network failure (succeeded: false + error). No retries, no fallbacks.
• assertModelsServed(opts) throws one ModelsUnreachableError naming EVERY model that is unlisted or failed its probe, with status + detail per model. A network failure rethrows rather than reporting a partial pass. Callers gate a campaign on it before spending.
• 13 deterministic unit tests with injected fetchImpl fakes: listed/unlisted, probe 200/401-with-body/503/nested-error, network failures → typed outcome, assertModelsServed naming all dead models, no partial silent pass.

Part 2 — docs/building-doctrine.md

Five present-tense doctrine sections (reachable defaults; platform-first debugging; agent findings are hypotheses; experiment-integrity checklist; fix the class not the instance). Each carries an "Enforced by" line naming the primitive/test that makes it mechanical — preflightModels / assertModelsServed / assertRealBackend / pairedBootstrap / assertCrossFamily / interRaterReliability (all verified to exist in the repo). One pointer line added to CLAUDE.md; no content duplicated.

Verification

• pnpm build green (incl. OpenAPI emit)
• pnpm typecheck green
• pnpm test green — 201 files, 1926 passed, 2 skipped (pre-existing)
• New exports reachable from the built root barrel
• Merges cleanly into origin/main (git merge-tree exit 0)