FN-5770: promote workflow interpreter to guarded lifecycle driver

Route default coding tasks through the workflow interpreter only when parity readiness checks pass.

- add a core cutover-readiness evaluator and exports for the workflowInterpreterAuthoritative flag
- wire a WorkflowAuthoritativeDriver into runtime dispatch and reuse authoritative lifecycle seams with legacy fallback behavior
- cover the cutover with reliability tests, docs updates, and a published CLI changeset

Files changed:
 .../FN-5770-workflow-interpreter-authoritative.md  |   5 +
 docs/architecture.md                               |   1 +
 docs/settings-reference.md                         |   5 +-
 docs/workflow-steps.md                             |  22 +-
 .../core/src/__tests__/workflow-cutover.test.ts    |  68 +++++
 packages/core/src/index.ts                         |   8 +
 packages/core/src/workflow-cutover.ts              |  81 ++++++
 .../src/__tests__/openclaw-runtime-e2e.test.ts     |   1 +
 .../engine/src/__tests__/pi-layers-wiring.test.ts  |   2 +-
 .../branch-recovery-live-zero-commits.test.ts      |   2 +-
 .../branch-recovery-stale-cached-base.test.ts      |   2 +-
 .../workflow-interpreter-cutover.test.ts           | 306 +++++++++++++++++++++
 .../self-healing-completion-fanout.test.ts         |   2 +-
 .../self-healing-ghost-branch-recovery.test.ts     |   2 +-
 .../self-healing-orphan-only-scope.test.ts         |   2 +-
 .../self-healing-reclaim-live-zero-commits.test.ts |   2 +-
 .../self-healing-stale-merger-status.test.ts       |   2 +-
 .../src/__tests__/step-session-executor.test.ts    |   2 +-
 .../__tests__/worktree-admin-entry-prune.test.ts   |   8 +-
 packages/engine/src/executor.ts                    |  13 +-
 packages/engine/src/index.ts                       |   6 +
 packages/engine/src/runtimes/in-process-runtime.ts |   8 +
 .../engine/src/workflow-authoritative-driver.ts    | 154 +++++++++++
 23 files changed, 686 insertions(+), 18 deletions(-)

Fusion-Task-Id: FN-5770
Fusion-Task-Lineage: dee668b5-10e0-4a3c-b025-9cc43a26286a

docs/workflow-steps.md

@@ -410,7 +410,7 @@ Run-audit events emitted in `database` domain:
 
 The parity contract is exported from `@fusion/core` (`compareWorkflowRunObservations`, `compareWorkflowRunAudits`) and produces deterministic drift reports shaped as `{ agree, diffs[] }`, where each diff includes field name, legacy/interpreter values, category, and severity.
 
-This is a dual-observe stage only; interpreter-authoritative cutover is deferred to a later phase.
+Dual-observe remains the rollout evidence path for the later authoritative cutover: the interpreter may only become authoritative when the separate `experimentalFeatures.workflowInterpreterAuthoritative` flag is ON **and** the cutover-readiness guard reports zero unresolved parity drift.
 
 #### Self-healing recovery for parked review tasks
 
@@ -480,6 +480,26 @@ Traversal semantics:
 
 Parity coverage includes flag-OFF no-op behavior, lifecycle ordering parity vs legacy seams, merge/file-scope-like failure routing, and downstream halt behavior for hard-cancel/self-healing style failures.
 
+### Interpreter-authoritative cutover
+
+A second default-OFF flag, `experimentalFeatures.workflowInterpreterAuthoritative`, promotes the interpreter from shadow/selected-workflow sequencing to the **authoritative** lifecycle driver for default coding tasks.
+
+The cutover stays opt-in, guarded, and reversible:
+- **Default OFF:** legacy executor/reviewer/merger/scheduler flow remains authoritative.
+- **Guarded ON:** the engine only routes through the authoritative driver when `evaluateInterpreterCutoverReadiness(...)` reports ready. The guard consumes explicit rollout evidence (cutover flag enabled, dual-observe enabled, non-empty parity observations, zero unresolved drift).
+- **Rollback:** turning `workflowInterpreterAuthoritative` back OFF immediately restores the legacy path; no migration or cleanup step is required.
+
+When the guard passes, the runtime binds real DI seams from `TaskExecutor` into the built-in coding IR and drives `BUILTIN_CODING_WORKFLOW_IR` through `WorkflowGraphExecutor`. The interpreter does **not** reimplement lifecycle behavior: it delegates execute/review/merge to the same legacy seams already used by the imperative path.
+
+Reliability invariants preserved under authoritative mode:
+- file-scope enforcement including `FileScopeViolationError`
+- squash/file-scope overlap enforcement via `assertSquashOverlapsFileScope`
+- `autoMerge: false` terminal-until-merged behavior in `in-review`
+- `moveTask(in-progress → todo)` hard-cancel semantics without stray `userPaused` rebounds
+- existing self-healing routing and fail-soft fallback behavior
+
+The interaction backstop lives in `packages/engine/src/__tests__/reliability-interactions/workflow-interpreter-cutover.test.ts`.
+
 ## Workflow Step APIs
 
 | Endpoint | Purpose |