feat(observability): tool-fitness SignalCategory in improvement_review — deprecation + consolidation candidates (suggest tier)

[williamzujkowski]

Part of #3850. Depends on #3851. Closes the #3692 sequencing (this is the SignalCategory's first consumer).

Context

improvement_review reads the ledger and emits 'tool-fitness' signals: deprecation candidates (low invocation + low success-correlation + stale lastUsed) and CONSOLIDATION candidates (overlapping tools — seed from the tool-distinctness governance check's similarity data). Suggest tier: candidates become rate-capped filed issues only with fileIssues=true, per the existing contract.

Acceptance criteria

• SignalCategory union extended ('tool-fitness'; add 'tuning'/'perf-regression' only if observability: No cross-domain feedback: outcomes from task execution don't inform self-eval thresholds or observability window... #3230/testing: Benchmark Results Not Linked to Component-Level Fitness #3246 land their producers first — else leave for them per the feat(observability): 'tuning'/'perf-regression' SignalCategory for improvement_review #3692 re-sequencing)
• Deprecation + consolidation candidate logic fixture-tested with honest thresholds documented
• Existing improvement_review rate caps + fileIssues default preserved (suggest tier)

Evidence required

Fixture tests; an end-to-end dry run against the real ledger.

Out of scope

Removing anything.

[williamzujkowski]

When this consumer is built on the #3851 tool-fitness ledger (merged), address the substantive concerns the #3898 ratification dissent (Contrarian, 6-1 approve) raised — they land on the CONSUMER, not the data layer:

1. Context-poisoning (highest priority): the ledger is homedir-global, so a tool failing in one workspace (local perms / missing deps / repo-specific) aggregates into a global fitness number and could wrongly flag it for pruning/deprecation elsewhere. Before using fitness for suggest-tier pruning, add an optional workspace/repo dimension to the ledger event (backward-compatible optional field) and scope/weight fitness by workspace so cross-workspace failures don't mis-penalize a healthy tool.
2. Concurrency: confirm JsonlStore's append/oldest-eviction is safe under concurrent multi-workflow homedir access (it's the shared feat(capability-loop): durably persist audit-mode soak data (vote/plan outcomes) for the enforce decision gate #3762 primitive behind PersistentOutcomeStore, so this is a pre-existing property to verify, not new — but verify before fitness drives any action).
3. Schema-fit: the feat(observability): tool fitness ledger — invocations, success correlation, last-used, cost #3851 ToolFitnessEventSchema was landed without its consumer; validate it actually satisfies this consumer's needs and evolve it (optional fields) as required.

Per Epic F's invariant: NEVER autonomous removal — fitness only ever feeds suggest-tier output.

🤖 Filed by Claude Code from the #3898 ratification vote.