Extend practice feedback and problem bank checks

[jserv]

This branch widens what a practice session gives back and tightens what the problem bank has to prove. Candidates can write their own test cases and see what their code returns, practice without a camera when the interview is not recorded, and get a post-interview debrief that states the hint rung they reached and the level they practiced for, while the report is refused if it names the published problem. The lobby keeps a longer history whose reports can be reopened, keeps due reviews across level changes, resets a failed review to one day, and shows progress by topic. The bank now accepts original exercises, every judge needs five cases including a boundary one, and a C starter that returns an array has to say who frees it. On the server, a provider whose credentials are refused leaves rotation, and report-model reviews during quiet pauses are capped per interview. CI gains a check that the release image matches the manifest's Rust version and a weekly run that requires the pinned avatar model, and the legacy migration paths for the git hooks and vendored files are removed. The interview contract moves to bundle 8, live prompt 3 and report prompt 8, with each step recorded in docs/interview-contract-versions.md.

Verified with ./scripts/test.sh at each of the 18 commits, not only the tip, and all pass; the tip runs 672 Rust tests and 523 browser tests with nothing skipped. The guarantees the commits claim were checked by breaking the guarded line and confirming a test failed: a prompt edit without a version bump, the interim review cap and its limit of 72, 401 and 403 provider refusal, the published-name check, judge case coverage, the C ownership note, and the version parity check. The candidate case fixes were reproduced before and after in Chromium. One upstream test this branch does not touch, setup_page_accepts_credentials_and_writes_the_primary_config_file in tests/cli.rs, failed once under load and passed on every rerun.

Deliberately left for follow-up: a report for an original exercise can still mention LeetCode, because the published-name check keys off a source title those exercises do not have; a sixth candidate case blocks the test run instead of being refused on its own; a null expected value breaks the palindrome checker; a mistyped class-case method breaks the whole C++ or Java compile; only four of the five candidate cases reach the reviewer; the parity check passes when neither version can be read; and the failed-review test cannot fail as written. A checkout that still holds web/vendor/avatar/jim.vrm from before the model moved to the browser cache now fails verify-vendor.sh until the file is deleted.

---

Summary by cubic

Expands practice feedback and report history while tightening problem-bank validation and release checks. The active interview contract is now bundle 9 with live prompt 3, report prompt 8, rubric 1, and report schema 2.

Practice and reports

• Candidate-authored cases are type-checked, run separately from judge totals, capped at five, and reach the interviewer and report.
• Reports now include debrief guidance, hint rung, volunteered hints, practiced level, topics, and neutral camera-skip conditions; published problem names are rejected or repaired.
• Prompt-only edits no longer invalidate stored scores; rubric and schema versions determine compatibility, with golden coverage for prompt version bumps.
• Full reports stay reopenable beyond the short history, due reviews survive level changes, failed reviews reset to one day, and progress groups by topic.
• Interim report-model reviews are capped by CODETRIAL_MAX_INTERIM_REVIEWS (default 12, maximum 72), while final reports retain complete context.

Problem bank and tooling

• Original exercises are supported, including generated rubrics and the new Bounded Event Queue problem; imported exercises keep published-source metadata out of candidate-facing data.
• Judges must provide five executable cases with a type-valid boundary case, C array-return starters must document caller ownership, and class harnesses validate arity and derive return types from contracts.
• Providers with fresh 401 or 403 responses leave rotation until credentials change and the server restarts.
• CI checks Rust release-image parity and scheduled avatar model delivery; hook and vendor migration paths are removed, and stale web/vendor/avatar/jim.vrm files must be deleted.
• CLI tests bound concurrent server processes and treat signal-killed processes as failures.

^{Written for commit f1ffc92. Summary will update on new commits.}