projection: begin the exact-path public epoch

The public tree and its history contain only the listed paths. Earlier projection history remains preserved internally.

Source-Sha: 913fde029b935671833254797f0f20f1eb9fabba

Policy-Sha: 913fde029b935671833254797f0f20f1eb9fabba

Tree-Digest: 180ae530c1058a2a5c89837bdce2d323ae83e669e38590ca72e75b8d92b7262f

agent/internal/guardian/interval_guardian.go

@@ -0,0 +1,63 @@
+package guardian
+
+import (
+	"fmt"
+	"sync"
+)
+
+// IntervalGuardian protects against accidental check-in interval overrides
+type IntervalGuardian struct {
+	mu               sync.Mutex
+	lastCheckInValue int
+	violationCount   int
+}
+
+// NewIntervalGuardian creates a new guardian with zero violations
+func NewIntervalGuardian() *IntervalGuardian {
+	return &IntervalGuardian{
+		lastCheckInValue: 0,
+		violationCount:   0,
+	}
+}
+
+// SetBaseline records the expected check-in interval
+func (g *IntervalGuardian) SetBaseline(interval int) {
+	g.mu.Lock()
+	defer g.mu.Unlock()
+	g.lastCheckInValue = interval
+}
+
+// CheckForOverrideAttempt validates that proposed interval matches baseline
+// Returns error if mismatch detected (indicating a regression)
+func (g *IntervalGuardian) CheckForOverrideAttempt(currentBaseline, proposedValue int) error {
+	g.mu.Lock()
+	defer g.mu.Unlock()
+	
+	if currentBaseline != proposedValue {
+		g.violationCount++
+		return fmt.Errorf("INTERVAL_OVERRIDE_DETECTED: baseline=%d, proposed=%d, violations=%d", 
+			currentBaseline, proposedValue, g.violationCount)
+	}
+	return nil
+}
+
+// GetViolationCount returns total number of violations detected
+func (g *IntervalGuardian) GetViolationCount() int {
+	g.mu.Lock()
+	defer g.mu.Unlock()
+	return g.violationCount
+}
+
+// Reset clears violation count (use after legitimate config change)
+func (g *IntervalGuardian) Reset() {
+	g.mu.Lock()
+	defer g.mu.Unlock()
+	g.violationCount = 0
+}
+
+// GetBaseline returns current baseline value
+func (g *IntervalGuardian) GetBaseline() int {
+	g.mu.Lock()
+	defer g.mu.Unlock()
+	return g.lastCheckInValue
+}