fix(combat): #279 allegiance comes from the scene, not the participant bucket

[MoonlightByte]

Fixes the combat-side consequences of #279. The origin is upstream and tracked in #337.

What was wrong

createEncounter buckets participants as npcs (carries a character sheet) or monsters
(is a stat block). combat_builder maps that bucket to type, and ensure_combatant_ids
maps type to faction: "npc" becomes "party". Every named villain with a sheet
therefore joined the party. resolver.validate_intent then made that invented table a hard
targeting gate, so Bandit Captain Gorvek was rejected for "cannot attack ally
cmb-player-eirik-vane-1" three times and handed a legalTargets whitelist containing only
his own men. He took it, and the narrator truthfully reported him killing them.

The model had already authored the correct answer. sceneFacts.relations said Gorvek was
hostile to the player, reconciled to exact combatant IDs and persisted by combat_builder.
Nothing in the repository read it, and the T096 payload never showed it back to the actor
agent -- which was shown the invented faction table instead.

faction is assigned once at creation and never mutated anywhere, so the gate also could not
express any mid-combat change of side: charm, domination, surrender and betrayal all invert
under it.

Changes

1. Show the agent its own facts. sceneFacts.relations and objectives ship in the T096
   payload for typed encounters, with prompt guidance that sceneFacts outranks
   type/faction, that type describes storage rather than side, and that a charmed or
   turncoat combatant keeps whatever faction it was created with.
2. Delete the same-faction "cannot attack ally" rejection. Remaining legalTargets hints
   are now truthful (living roster minus self).
3. Correct the side at creation. apply_scene_declared_sides() promotes a participant to
   hostile only when the scene explicitly declares it hostile toward the party side.
   One-directional by design: it can promote, never demote. Demoting an adversary would end a
   fight early; promoting an ally would make all_hostiles_resolved unsatisfiable and hang
   the encounter. The player is never promoted. Dispositions are compared as exact values,
   never pattern-matched; an unrecognised disposition is a no-op.
4. XP counts hostility, not buckets. utils/xp.py guarded on type == 'enemy'; it now
   guards on is_hostile(). The guard change alone would have made creature['monsterType']
   raise KeyError inside the completion path, so that access is now safe.

The eight factual gates are untouched: unknown actor, actor cannot act, stale stateVersion,
outside the turn window, unknown target, target already down, ability not on sheet, no
ammunition. Code keeps identity, canonical state, ordering and arithmetic; who counts as a
friend goes back to the agent.

Absence-safe throughout. Legacy encounters never reach this resolver
(combat_orchestrator.py:1081 gates on pipelineMode == "agentic"), pre_typed encounters
carry no sceneFacts, and encounters already on disk are never migrated.

Evidence

Deterministic replay of the real captured encounter through the production functions,
61/61 across three harnesses (24 targeting, 28 sides, 9 XP): all five observed
ally-rejections now pass, all eight factual gates still fire, one-directional safety holds,
and legacy / pre_typed / unknown-contract / malformed-relation inputs are all no-ops. The
fight no longer auto-completes with the boss standing, and does complete once he is down.

Live OpenAI T096 A/B, same encounter, same turn, same model:

	sceneFacts sent	boss friendly-fire
unmodified origin/main	no	3 / 4 samples
this branch	yes (5 relations, 2 objectives)	0 / 8 samples

3-of-4 on baseline matches the 3-of-6 originally observed in #279. Adversarial live probes: a
charmed bandit (faction still hostile) attacks his own captain, and a turncoat companion
(faction still party) attacks the PC -- both impossible under the old gate. With relations
and objectives both emptied, the agent still does not fall back to type/faction.

Reviewer notes -- please read before merging

• Evidence class is development, not acceptance. This ran under WSL. Native Windows is the
  platform of record and NEQ-EVIDENCE-04 acceptance items are not satisfied, so by Design Constitution & Plan Review Protocol — CANONICAL source of truth for all design and planning (Claude + Codex; version in body) #193 this
  is not a PASS. The deterministic replay used the real native run artifacts.
• No Design Constitution & Plan Review Protocol — CANONICAL source of truth for all design and planning (Claude + Codex; version in body) #193 Part 3 plan review was run. This went from investigation to implementation on a
  verbal go-ahead. Change 2 deletes a validation gate on a play path, which is the kind of
  change that protocol exists for.
• Change 2 is the one to scrutinise. If the judgement is wrong, the failure mode is NPCs
  choosing incoherent targets with no deterministic backstop. The argument for removal: the
  gate cites no observed failure (27a25ce2 is a one-line commit message), it cannot cover
  charm/turncoat/surrender so it is a gate not every path passes, and its worst case -- proven
  by TW05-E1: Bandit Captain Gorvek is created as type npc / faction party, so the boss attacks his own warriors #279 -- is worse than what it prevents. Legacy ran for months without it.

Not fixed here

• Semantic validation reclassifies a named hostile as an encounter NPC, inverting the scene #337 -- T065 semantic validation reclassifies a correctly classified boss before
  combat_builder runs. That is the origin; this PR repairs the consequences.
• Boss XP is still 0. He is now counted as a defeated hostile, but a sheet-based hostile
  has no stat block and no challengeRating, so there is nothing to price the kill with.
  Awarding nothing and warning is deliberate; deriving a CR from level or HP would be code
  inventing meaning from missing data. Fixing Semantic validation reclassifies a named hostile as an encounter NPC, inverting the scene #337 routes him through monster_builder, which
  produces a CR, and this resolves itself.
• all_party_resolved (combat_state.py:314) still counts him as party via
  type in ("player","npc"), which faction cannot override. Observed effect was nil and
  changing that disjunct has legacy blast radius; left for [EPIC][combat] Recover agentic-first combat while preserving the proven legacy player experience #191.

Refs #279, #337. Doctrine: #193 NEQ-COMBAT-02, AP-6, AP-7, NEQ-CORE-01, NEQ-CORE-06,
leanness tests 1-3.

🤖 Generated with Claude Code

https://claude.ai/code/session_01CKDbsAQBJqRUp8QjeqtfvM