feat(v2): T11 改进治理与演示交付——对照门禁、泄漏作废、三模块演示脚本

覆盖 AC-15/16/34/37/41（BR-15/16/40、E-11/24）。

后端：
- contracts/improvement.py：ImprovementCandidate + ContrastReport/ContrastMetrics。
  零分母不得给比率或覆盖率（样本不足不是 0%）；非独立评测不得给改进/退化结论；
  已发布必须引用既有不可变版本；没有对照证据不得进入待审核或已发布。
- services/improvements.py：
  · evaluate_contrast 在服务端判定泄漏——预测锁定前读到标签即整次评测作废（E-11），
    保留集来源进开发集的样本作废并单列，指标按分子/可观察分母/覆盖率/未观察分开报；
  · transition 状态机：draft→evaluating→ready→in_review→approved→released，
    自批拒绝、退化与结论不明拒绝发布、发布幂等且只引用既有版本、撤回只影响新运行。
- api/prescreen.py：候选列表、提出与状态机三个端点；评测请求体提交样本，
  泄漏与指标一律由服务端计算，不接受客户端交来的"成品报告"。
- contracts/prescreen.py：补 E-11/E-24 错误码与 409 映射。

前端一致性修正：
- src/lib/prescreen-run.ts 的呈现判定改用后端既有词汇
  （empty/list/grouped/radar/faceted，与 services/review_plan.presentation 一致），
  避免前后端各一套判定导致界面画出后端判定为不该画雷达的图。

演示交付：
- scripts/xingbang_prescreen_demo.py：按 08 §7 八步演示，只驱动已实现入口，
  未实现的步骤（批量清单、历史提炼、卡片治理）如实标注原因；
  工程演示与模型效果分列，本地专项/Jev/真实概率一律标未验证或未接通。
- backend/test_demo_script.py：冒烟断言八步状态、未实现原因与分列口径。

验证：backend 全量 unittest 519 项 OK；前端 npm run build 通过。

Co-Authored-By: Claude Code <noreply@anthropic.com>

backend/api/prescreen.py

@@ -33,6 +33,7 @@ from pydantic import BaseModel, ConfigDict, Field
 from api.project_assistant import enabled
 from api.risk_agent_access import authorize, check_project
 from contracts.prescreen import (
+    DESC_MAX,
     EVIDENCE_MAX,
     ID_MAX,
     MAX_BATCH_FILES,
@@ -42,7 +43,8 @@ from contracts.prescreen import (
     S1_ERROR_RETRYABLE,
 )
 from services import assistant_store as store
-from services import fact_conflict, material_import, prescreen_sandbox, prescreen_store, trajectory
+from services import (fact_conflict, improvements, material_import, prescreen_sandbox,
+                       prescreen_store, trajectory)
 from services.assistant_settings import flags
 from services.fact_conflict import FactConflictUnresolved
 from services.project_assistant import ProjectAssistantService
@@ -92,6 +94,28 @@ class SimulationInput(Input):
     expected_revision: int | None = Field(default=None, ge=1)
 
 
+class ImprovementInput(Input):
+    """T11 改进候选。必须说明改什么、依据哪些运行或结果。"""
+
+    target: str = Field(default="knowledge", max_length=40)
+    target_ref: dict
+    proposed_revision_ref: dict
+    change_summary: str = Field(min_length=1, max_length=DESC_MAX)
+    source_run_ids: list[str] = Field(default_factory=list, max_length=200)
+    outcome_ids: list[str] = Field(default_factory=list, max_length=200)
+
+
+class TransitionInput(Input):
+    """状态机动作。评测动作必须随请求提交对照结果，不能只改状态。"""
+
+    action: str = Field(min_length=1, max_length=40)
+    expected_revision: int | None = Field(default=None, ge=1)
+    evaluation: dict | None = None
+    contrast: dict | None = None
+    released_ref: dict | None = None
+    reason: str | None = Field(default=None, max_length=DESC_MAX)
+
+
 class OutcomeInput(Input):
     """T10 会议结果。原始结果码必填；未提供时不得推断成通过或否决。"""
 
@@ -518,3 +542,57 @@ def record_review_outcome(project_id: str, payload: OutcomeInput, request: Reque
                                      known_snapshots=snapshots)
 
     return run(request, action)
+
+
+# ---------------------------------------------------------------- 改进治理（T11）
+@router.get("/projects/{project_id}/improvements")
+def list_improvements(project_id: str, request: Request, status: str | None = None):
+    blocked = scope(request, project_id)
+    if blocked is not None:
+        return blocked
+
+    def action():
+        with _db() as db:
+            return improvements.listing(db, project_id, status)
+
+    return run(request, action)
+
+
+@router.post("/projects/{project_id}/improvements", status_code=201)
+def propose_improvement(project_id: str, payload: ImprovementInput, request: Request):
+    """提出改进候选（草稿）。发布仍须经过对照、独立审核两个门。"""
+    blocked = scope(request, project_id)
+    if blocked is not None:
+        return blocked
+
+    def action():
+        with _db() as db:
+            project = _project(db, project_id)
+            return improvements.propose(db, project_id, payload.model_dump(),
+                                        _actor(request), project["data_domain"])
+
+    return run(request, action)
+
+
+@router.post("/improvements/{candidate_id}/transitions")
+def transition_improvement(candidate_id: str, payload: TransitionInput, request: Request):
+    """候选状态机。泄漏按 E-11 拒绝，未通过对照/审核按 E-24 拒绝。"""
+    def action():
+        with _db() as db:
+            probe = store.get(db, improvements.KIND, candidate_id)
+        blocked = scope(request, probe["project_id"])
+        if blocked is not None:
+            return blocked
+        try:
+            with _db() as db:
+                return improvements.transition(
+                    db, candidate_id, payload.action, _actor(request),
+                    payload.expected_revision, evaluation=payload.evaluation,
+                    contrast=payload.contrast, released_ref=payload.released_ref,
+                    reason=payload.reason)
+        except improvements.LeakageDetected as exc:
+            return _envelope(request, ErrorCode.EVALUATION_CONTAMINATED, str(exc))
+        except improvements.NotValidated as exc:
+            return _envelope(request, ErrorCode.IMPROVEMENT_NOT_VALIDATED, str(exc))
+
+    return run(request, action)