workflow state machine: evidence can outrun the checklist; pass rows offered before a pass opens

Two related frictions observed in live runs on lab/cs2-plugin (e2e workspaces, 2026-09-02):

1. Evidence outran the checklist. In test-e2e-20260902, the spec's reviewHistory carried completed reviews for structural-pass and form-refinement (with fresh renders/comparison sheets per pass) while state.json still said currentPass: structural-pass with every pass row pending and only blockout archived in passHistory. The session advanced via append_review/pipeline-sync without marking pass rows; nothing reconciles the two. Consequence: plugin-gates/emission-target were never reached through the machine even after 4 passes of real work.
2. Pass rows offered pre-pass, then reset. A headless e2e agent reported next.py offering pass-scope steps immediately after init while currentPass is "", with the first real next.py call then resetting them — it lost a pass of work to this.

Design question to settle first: is the spec (reviewHistory) or the checklist the authority for pass progression? Options include append_review refusing entries for passes whose checklist rows aren't done (couples spec tooling to workspace state), or pipeline-sync back-marking checklist rows from reviewHistory (accepts the spec as authority and keeps the checklist honest as an index).

Related: #122 (mandatory domain-review attachment) — the same run used the optional-attachment gap; the two together are why the terminal gates path has never executed in a real run.