CI compute cost of verification

Invariants make an agent change behaviour to turn the suite green

A dev.to write-up argues that any suite an agent can read is a target, so it swaps expected values for invariants, pins fixtures by sha256, and quarantines flakes before the agent runs anything. The example's own arithmetic shows where layer one stops.