code-to10 v6 A3: enforce signer separation on audit-verdict submission

process_audit_verdict now calls validate_signer_separation
before any state save or ledger write (previously the function
had no production caller on this path: it only ran inside
collect_failed_checks via decide_pushback, which itself has no
production caller). Signer is bound to the authenticated
caller -- a body signer differing from the caller is rejected
-- and executor/coordinator_approver/qa_tester must be
declared and distinct from the caller; missing field,
self-audit, or forged signer raises ValueError, mapped by
_loop_run to HTTP 400 with no side effects. No new route.
Honest limits are in the helper docstring: declared-identity
enforcement only (task rows store no authoritative executor /
coordinator / QA identity; task executor is a backend, not a
person), and audit-fix reaudit verdicts are out of scope
(the fix poster is not necessarily the re-auditor, so binding
signer to the fix poster would be a mis-binding).

(cherry picked from commit 56dce5165f4d08f38fe1730b9eea3b78f90cb97d)

Reconcile-port: handler_lifecycle.py docstring hunk redirected into cloud/server.py audit-verdict handler (target keeps 6-mixin split; enforcement itself is in audit_loop_wiring.py and applied cleanly).

cloud/server.py

@@ -7240,7 +7240,10 @@ class CloudControlPlaneHandler(OAuthMixin, IdentityMemoryMixin, ProjectMixin, Au
         maintainer 以上，与合并权同级；普通 contributor 不能
         凭空给循环喂结论）。体：{module_id, contract_version,
         verdict: {verdict, source, failures, ...},
-        old_impl_ref?}。原任务状态不动；fail 自动派生修复子
+        old_impl_ref?}。signer 分离（A3）：提交方本人即 signer，
+        verdict 须另声明 executor / coordinator_approver /
+        qa_tester 且均与提交方不同，缺字段、自审或体里 signer
+        与调用方不符一律 400 且不落链不推进。原任务状态不动；fail 自动派生修复子
         任务并经链阻塞合并/发布。"""
         body, jerr = self._read_json()
         if jerr: