fix(capture): mask rollouts with unconfirmed terminal IDs

[yaoyu-33]

Expected

When a tokenless rollout declares terminal_response_id, capture reconstruction should mask the sample if that ID cannot be confirmed, even when the captured calls form one clean chain. Masked capture evidence should remain available.

Actual

Terminal attribution rejects an unknown declared ID, but the consumer then applies its ordinary single-chain fallback. It returns mask_sample=False, allowing the captured chain to be used with the rollout reward and making its evidence eligible for retirement.

Fix

Mask unconfirmed declarations at the shared consumer boundary. Extend the existing file-store finalization regression to cover a single chain as well as auxiliary roots, and check retirement eligibility and unchanged reward. Valid declarations and the existing fallback without a declaration keep their behavior.

This enforces the declaration contract introduced in #2872; no separate issue is needed.

Validation: 246 focused capture tests, core and sandbox suites, the coverage gate, and all-file pre-commit passed. Model rollouts are N/A for this shared finalization-only change.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.