RV-S6: Tier I idempotency eval passes after SQL errors (ON_ERROR_STOP missing) #180

What happened

External repo review at commit c7bebd1 reproduced: Tier I idempotency eval invokes psql without ON_ERROR_STOP. A scratch launcher containing SELECT 1/0; produced SQL errors on both attempts, yet the scenario passed because process exit codes and existing row counts still satisfied its checks.

Code path: evals/runner.py L352–382.

Why this matters

The Tier I eval is one of the gates for the offline install (#60) evidence. If a tenant's deployment hits a real SQL error during idempotent re-apply, the current eval does not detect it. Silent SQL failures passing idempotency checks is exactly the failure mode this eval is supposed to catch.

Proposed

1. Add -v ON_ERROR_STOP=1 to the psql invocation in evals/runner.py L352–382.
2. Verify schema version and structural invariants (not just row counts) after re-apply.
3. Add a negative control: a scratch launcher with a forced SQL error that the eval must now fail on.

Done when

• Reproduction case (scratch launcher with SELECT 1/0;) fails Tier I.
• Legitimate idempotent re-apply still passes.
• Negative control committed as a Tier I scenario.

Reference

Tracker row G39. Repo review finding RV-S6. Related to RV-S7 (SQL assertion wrapper exit code) and #60 (offline install evidence trust).