Require independent verification in public AL triage

[Thaddeus Loke (thloke)]

This makes the public AL issue workflow treat reporter statements as claims and require an independently executed product-path attempt before an in-scope compiler, tooling, or runtime conclusion can pass validation.

It adds a safe prerelease-ALTool MCP wrapper for issues involving al_build/al_compile, strengthens the triage prompt and agent contract, and rejects claim-only, unattempted, or blocker-free evidence for in-scope reports.

An independently executed bug that no longer reproduces on the relevant latest-prerelease product path is now a terminal likely fixed scope. The validator requires not reproduced evidence and a recommendation to close as likely fixed; it rejects inconclusive results, non-bug classifications, negated closure recommendations, and any recommendation to apply accepted or create internal follow-up.

Verification

Scenario	Command / run	Result
Workflow contract tests	pwsh -File .\scripts\Test-AlIssueTriageWorkflow.ps1	Passed
Branch dry-run against #8309	Actions run 32233940815	Passed without posting a comment
Latest-prerelease non-reproduction against #8218	Actions run 32337970243	Exposed the need for a terminal likely-fixed outcome instead of acceptance
Independent MCP reproduction	run-al-mcp-tool with al_compile, al_build, and al_getdiagnostics	Reproduced AL0451 with empty assembly probing paths using an independently constructed fixture; a control project compiled successfully

Review attention

The validator reserves not attempted for out-of-scope or inapplicable routes. In-scope compiler/tooling reports must execute ALTool, and in-scope runtime reports must execute the BC runtime route or identify an exact attempted invocation and blocker.

likely fixed is deliberately separate from in scope: it requires a successful latest-prerelease product-path attempt with not reproduced evidence and recommends closing without accepted.