Atomically commit extraction outcomes and disposition audit

[jimador]

Goal

Atomically persist extraction-run outcomes, disposition audit, and accepted propositions
after the host supplies its policy decisions.

Context

The pipeline returns unsaved propositions, while legacy convenience paths persist
internally. The new path needs one DICE storage contract so a host crash cannot leave a
completed run without products or committed products without their run and disposition.

Acceptance criteria

• The commit input contains run state, typed product outcomes, host disposition
  decisions, accepted products, review records, and rejection records.
• One transaction persists accepted propositions, run links, outcomes, and audit.
• Retrying the same commit is idempotent.
• Failed commits leave the run retryable and do not complete its analysis claim.
• Partial product success is preserved without committing failed products.
• Review, reject, demote, and projection-exclusion decisions remain queryable.
• Drivine integration tests cover crash boundaries, retry, partial success, and tenants.

Constraints

• Depends on durable extraction runs.
• The host application composes policy; DICE owns persistence and transaction execution.
• Legacy persistence remains available during migration.

Out of scope

• Host policy implementation.
• Source revision detection.
• Exactly-once delivery outside the DICE store transaction.

Original request

Close the extraction-to-persistence gap with a durable commit boundary that preserves
successful work, audit decisions, and retry safety.