Intersect, Don't Union: Three Trust Classes for Agent Patch Tests

Stop merging because the whole suite is green. An agent that writes both the patch and the tests can add passing cases that never discriminate a fault. Merge only when three trust classes independently agree: human-owned oracles still fail known-bad fixtures, property checks pass on recorded seeds, and flaky tests are frozen out of the verdict....