3b increment 5b: wire pkgstate verification into .commit_session

[TroyHernandez]

Wires step 6 of the commit lifecycle (contract §4.3 / §4.7) into `.commit_session` -- the last deferred step before the exported per-verb API. The predicates from 5a now run inside the lifecycle and their verdict is captured onto the outcome.

What lands

• `.verify_and_capture(outcome, preview)` runs `.verify(preview)` and captures `verified` / `verify_detail` onto the returned `pkgops_outcome`.
• Step 6 runs only on the success path (`is.null(decided$condition)`: an `ok`/`no_op` that will be returned, not signaled). A known failure already carries its own condition, and a left-open effect is unknown, so neither has a trustworthy post-state to check.
• By the time step 6 runs the commit has applied, so the reader observes the post-state.

Invariants held

• Never raises. `.verify()` already normalizes malformed reader/record data to `verified = FALSE`; `.verify_and_capture` adds a belt tryCatch so a residual error can never abort before `write_outcome`. A disagreeing post-state is `verified = FALSE` + a detail on the outcome, not a signal.
• Outcome-before-signal (§4.8). Verification is observational -- it never changes the close/open decision -- so the outcome is still written (step 7) and the ordering holds.
• Independent of the helper status (§4.7). A clean `ok` whose post-state disagrees is a verification failure (covered by a test).
• Hermetic. The dpkg reader stays behind the injectable seam; `.commit_session` tests run against fake session-ops + fake pkcheck + fake reader, no root/broker/dpkg.

Scope boundary

The durable-record post-state fields (`observed`/`changed`) that carry the verdict to the broker remain the VM-gated increment; here the verdict lands on the returned outcome object only. `.outcome_record()` stays minimal. The exported per-verb `apt_()` entrypoint is still its own later increment.

Verification

• 553 tests pass (25 new in test_commit.R step-6 section, incl. counting-reader proof that verification runs exactly once on success and zero times on failure/left-open paths).
• R/ ASCII-clean; `R CMD check` 0 errors, 0 notes, 1 expected New-submission / non-CRAN-deps WARNING.
• Version bumped to 0.0.1.7 (separate commit); NEWS + CLAUDE.md updated.

Held as a draft for review.