feat(addie): give Sage a distinct certification voice

[bokelley]

Summary

• add an explicit Addie-to-Sage handoff and voice exemplars across standard, build, specialist, and delta certification flows
• make the Sage identity exception trusted, non-repeating, trim-safe, and recoverable for active attempts
• align the instructional-design framework and bump the Addie code version
• add handler-level coverage for starts, resumes, active deltas, stale attempts, and rule composition

Validation

• npx vitest run --config server/vitest.config.ts server/tests/unit/certification-module-methodology.test.ts server/tests/unit/rules-loader.test.ts (35 tests)
• npm run typecheck
• git diff --check
• prompt, education, and code expert reviews approved

Closes #3446

[aao-secretariat]

Ladon verdict: Approve

Approve — Addie-to-Sage certification handoff and Sage identity rules, with handler-level test coverage.

Checked:

• bolt-app guardrail: switch from inProgress.length === 0 to !certContextText correctly suppresses the no-module warning when recovered delta context exists. Sound.
• Delta recovery bounds: DELTA_DEFINITIONS N=1, in_progress-only, 30-day staleness cap — bounded, not open-ended.
• Identity exception: anchored to trusted system/tool surfaces, not learner text, preserving the fail-closed anti-model-disclosure guard.
• Changeset scope: no static/schemas/source/**, dist/**, or normative docs/reference/** surface touched — this is an Addie/app-only change, so no changeset is required and none is added (correct per changeset-scope rule).
• high_risk: true only via (modified) matches under server/src/addie/**; no deletions, no medium-or-higher findings on those files, so the flag is a look-closer signal only, not an escalation trigger.

Row analysis: no critical/high findings (row 1 no); gated_paths false (row 2 no); no deletions (row 3 no); no medium findings at all (rows 4/5/8 no); no prior escalation (row 6 no); no no-auto-approve team match (row 7 no). Falls through to row 9 → approve.

Note: review_decision is REVIEW_REQUIRED, but gated_paths is false and no prose hard gate applies (no protocol/spec/breaking-class change), so the required-review status does not force escalation.

Medium findings: none.

Nit (non-blocking): certification-tools.ts:701 — delta recovery adds a per-turn DB lookup on the Addie hot path for mapped users; consider caching if latency becomes an issue.

[aao-secretariat]

Re-approval: no reviewable delta since the prior approval; re-submitting after stale-review dismissal.