recife spec of the verdict-handoff CAS/idempotence protocol as a safety +
liveness model (a plan->commit handoff).

REQUIRES recife on the classpath — load it LAZILY (never require this ns from
hive-recife.core). `safety-spec` yields a hive-recife.schema/ModelSpec ready
for hive-recife.core/check!.

Protocol: a verdict is planned over a content-hash snapshot; files may DRIFT;
the verdict may EXPIRE; COMMIT is a compare-and-swap that applies the patch
ONLY when the verdict is still planned and the plan-hash still matches the
file-hash. The safety invariant `never-apply-stale` asserts a stale verdict is
never applied; commit freezes the observed hash into ::applied-hash so the CAS
precondition is inductively checkable.