Make shadow evaluation failure-isolated and observable

[ocularminds]

Context

ShadowPipeline.compare waits on production execution and authority evaluation through one Promise.all. A slow or rejected hypothetical decision can delay or reject the caller even after the production action ran, which weakens shadow mode as a safe observation-only migration tool.

Acceptance criteria

• Ensure shadow evaluation cannot change the production callback invocation count, authorization path, result, or error.
• Bound shadow evaluation independently and return a structured status for decision received, unavailable, timed out, or invalid rather than rejecting a successful production result.
• Preserve the explicit SHADOW label and make shadow results impossible to use as executable GateDecision values through both types and runtime checks.
• Define behavior when production execution fails while shadow evaluation succeeds or is still pending.
• Add correlation and duration fields suitable for the redacted audit interface without copying raw parameters or provider results.
• Add deterministic tests for slow, rejected, malformed, and successful authorities plus production success and failure; document rollout and sampling guidance.