Anchor: freeze campaign/piece acceptance criteria at intake and gate "done" on verified AC

[wesleysimplicio]

Parent epic: #64

Goal

Port simplicio-loop's task anchor (scripts/task_anchor.py) to the marketing domain: a durable campaign anchor that freezes the goal, KPIs, and acceptance criteria at campaign intake, re-checks them every loop turn, and blocks any "campaign complete" / "piece done" transition while an AC is unverified.

Scope

• anchor create at campaign intake: freezes SaaS brief, ICP, primary KPI, per-piece AC (compliance pass, tech-specs pass, 4-platform captions, evidence recorded), and DRY_RUN posture.
• anchor check on every loop turn: compares current work against the frozen goal and flags drift (e.g. the loop starts generating pieces for a channel that is not in the campaign plan, or rewrites the KPI mid-flight).
• anchor gate at completion: item-by-item AC verification; any unverified item → exit non-zero, status blocked. Human override must be an explicit logged event, not a bypass.
• Anchor file lives under the campaign's artifact tree (e.g. outputs/<client>/<campaign>/anchor.json) and is append-only for status transitions.

Acceptance criteria

• A campaign cannot be marked complete while any AC is unverified (gate exits non-zero, blocked).
• Drift detection has at least one test: a piece targeting an out-of-plan channel is flagged.
• The worker runs standalone with a selftest and is covered by the local check gate (see check-script issue in this epic).
• Frontmatter/manifest link each piece to its anchor entry so evidence maps 1:1 to AC items.