Add bounty AI assistance disclosure guard

[pine-harbor]

/claim #18

Summary

Adds bounty-ai-assistance-disclosure-guard/, a self-contained Scientific Bounty System guard for solver AI-assistance disclosure and provenance.

The guard analyzes synthetic bounty-submission packets before sponsor/reviewer scoring and emits deterministic RELEASE, REVIEW, or HOLD decisions with evidence-linked remediation for:

• challenge AI-use policy compatibility
• required AI-use disclosure
• approved tool list and tool-license compatibility
• prohibited data classes sent through AI workflows
• private sponsor data in AI or final packets
• prompt, bearer token, or secret-like leakage
• human review attestation for AI-assisted work
• generated component disclosure, provenance hashes, review status, and submission-license fit
• reproducibility commands and environment evidence

Issue #18 fit

• Submission engine: validates solver submission packets before scoring or sponsor handoff.
• Secure private workspaces: detects private data and prompt/secret leakage before reviewer access.
• Arbitration and reviewer checklists: emits severity-coded findings, decisions, confidence, evidence, and remediation.
• IP and licensing options: checks generated component and tool licenses against challenge policy.
• Audit logs and reproducibility: requires provenance hashes, human review, and reproducibility commands.
• Multi-phase challenge support: decisions can be run before proposal, prototype, final scoring, award release, or sponsor handoff.

Validation

Locally verified on Windows:

npm.cmd test
# tests 7
# pass 7

npm.cmd run demo
# packetCount 4
# RELEASE 1 / REVIEW 1 / HOLD 2

npm.cmd run video
# reports/demo.mp4 generated

npm.cmd run check
# syntax checks passed

git diff --check
# passed

ffprobe reports/demo.mp4
# H.264, 1280x720, 8.000 seconds, 30 fps, 240 frames

Demo and privacy

The demo MP4 is generated from an FFmpeg synthetic color background plus hard-coded text overlays. It is not a screen recording and contains no desktop/browser capture, notifications, real user data, credentials, private submissions, or local personal information.

Safety

Uses synthetic data only. No external AI APIs, credentials, private submissions, payment systems, network calls, or live sponsor data.

AI assistance disclosure

Implemented with Codex assistance and verified locally with deterministic tests and generated artifacts.