Spec uncertainty engine + repoint ledger to @rafters

[ssilvius]

Summary

• Spec for the uncertainty engine -- the AI honesty layer for the studio. Generic input -> prediction -> outcome ledger; per-cohort Brier scores and reliability diagrams; five-state lifecycle (emitted, witnessed, calibrated, orphaned, retired). See docs/designs/uncertainty-engine.md.
• Repoint @ezmode-games/drizzle-ledger -> @rafters/ledger@0.2.0. The CLAUDE.md rewrite (3c6e23b) missed apps/web/src/api/auth.ts and the package.json declarations, leaving main with a broken typecheck. Restored to green.

The institutional read

Other agents build models. Platform audits them. Every confidence number Rafters publishes is grounded in a published reliability record. Same ethic as publishing the revenue split.

The orphan state is load-bearing: silence is its own state, scored separately, surfaced as a metric. Treating silence as agreement poisons calibration upward; treating it as disagreement poisons it downward. Naming it removes the choice.

Phase 1 work breakdown

Issues #97-#103:

• Uncertainty engine: D1 migration for uncertainty_prediction + uncertainty_calibration_snapshot #97 D1 migration (uncertainty_prediction, uncertainty_calibration_snapshot)
• Uncertainty engine: Drizzle schema + zod companions #98 Drizzle schema + zod companions
• Uncertainty engine: Hono routes (emit, witness, calibration, orphans) #99 Hono routes (emit, witness, calibration, orphans)
• Uncertainty engine: orphan sweep cron #100 Orphan sweep cron (hourly)
• Uncertainty engine: calibration roll cron + Brier/reliability SQL #101 Calibration roll cron + Brier/reliability SQL (nightly)
• Uncertainty engine: rafters integration (color naming + service binding flip) #102 rafters integration + service binding flip from ezmode-api to platform
• Uncertainty engine: ctrl debug page for calibration snapshots #103 ctrl debug page for calibration snapshots

Test plan

• Spec reads cleanly; tables render in GitHub
• pnpm typecheck passes (verified locally)
• pnpm install clean against @rafters/ledger@0.2.0
• better-auth ledgerPlugin import resolves at runtime (smoke test on next deploy)