Human Verification System — additive on TestRun + HumanVerification + FeatureConfidenceRollup

---
feature_id: FEAT-studio-qa
size: L
module: qa
phi_in_scope: true
has_migration: false
write_sets:
  - packages/qa/src
  - packages/database/prisma/schema/qa.prisma
  - apps/web/src/app/(app)/[team]/qa
  - packages/qa-inbox-ui
---

## Context

PDT-approved. Memo: https://www.perplexity.ai/computer/tasks/47e629f8-3cd8-4f1c-9b23-092f0ed8c47b

Ship the Human Verification System as additive layers over the existing Studio QA fabric (`qa.prisma`) rather than a parallel table family. The `TestCase.featureId` join key + `TestRun.evidence` + `AiTriageLog` already carry every claim a dossier renders; the dossier is a read model, not a write model. Verification writes reuse the `PhiHarmScan` all-set-or-all-null CHECK-constrained verifier trio.

Repo state at PDT approval:
- operant-studio HEAD 1113e5d
- portico HEAD da830ff
- qa.prisma 587 lines, 12 models -- no `HumanVerification`, `FeatureDossier`, `experienceScore`, or `smiley` matches
- Precedent: `PhiHarmScan.humanVerdict/By/At` trio at `phi-guard.prisma:41-48`
- Precedent: `CoverageCell` materialized per (team, project, feature, kind) at `qa.prisma:139`

## Acceptance Criteria

- Five children filed and linked to this parent
- Each child scoped so a single agent run can complete it end-to-end (Plan -> Execute -> Review)
- Schema migration child is Stronghold (adds PHI-adjacent `probeText` -- Marisol conditional sign-off requires `/// @PHI` + `redactPhi()` + `AuditLog READ_PHI` in the same PR, else sign-off flips to a veto)
- Renderer, charter generator, rollup materializer, and internal UI children are Safeguard tier
- No user-facing exposure of the smiley beyond internal Studio verifiers until a separate PDT approves Fiesta rollout

---
<!-- planner-rescope: phi_no_reviewer -->
**Planner rescope (phi_no_reviewer):** Task has phiInScope=true but no PHI-eligible reviewer is available. Register a reviewer worker advertising the `phi` capability before admitting PHI work.