docs: capture verification agent contract

[bingran-you]

Summary

• add a native-test-derived verification-agent-contract.md leaf under tools-and-permissions/tool-catalog
• record the built-in verification agent's availability gates, disallowed tools, verification strategy, and verdict grammar
• link the new leaf from tools-and-permissions/tool-catalog/NODE.md

Source Mapping

• primary: tools/AgentTool/built-in/verificationAgent.ts
• supporting: tools/AgentTool/builtInAgents.ts
• supporting: tools/AgentTool/constants.ts
• supporting: tools/AgentTool/AgentTool.tsx

Coverage Delta

• new coverage for the built-in verification agent contract as a reconstruction-critical verification asset
• explicitly captures higher-precedence catalog bypasses, feature gating, background launch intent, disallowed authoring tools, adversarial verification posture, and exact VERDICT: PASS|FAIL|PARTIAL output requirements
• no overlap with the already-landed sedValidation.ts verification asset except shared verification-asset conventions

Verification

• npx -y -p first-tree first-tree verify

Risks / Open Items

• this PR captures the verification-agent contract only; permission-testing and mock-scenario lines still need their own source-backed assets
• it does not yet define downstream oracle/fixture schema for future replay or automated trace comparison