chore(ai): re-baseline the decision-cost perf gate onto post-#6826 cost - #7053

Investigator 1/3: Investigator 1 reviewed 30 hydrated PRs (5 with full patches, 5 with patch previews, 20 metadata-only) across the contributor's shard. All fully hydrated patches show legitimate, high-quality development on a Magic: The Gathering rules engine and client (phase-rs/phase). The contributor is a MEMBER of the target organization. Full-patch PRs include: (1) AI target-selection fix for unmodeled spells in crates/phase-ai/src/search.rs - adds defensive fallback to engine-issued domain with recursive effect-tree inspection and unit tests; (2) Storm mechanic UI feature spanning client hand/stack components and engine derived_views - adds localized storm copy count badges; (3) Engine filter-context scoping fix in casting.rs to bind object-scope reads to published set members with corrected CR citation and expanded test coverage; (4) Mana-payment feasibility witness for costed tap lands in casting.rs and related files - bounded simulation with no network or persistence side effects; (5) Documentation-only update to .claude/skills/engine-implementer/SKILL.md. Preview PRs cover test reliability fixes, AI measurement-mode determinism, automated metagame feed refreshes, card-hover UI fixes, and exile-permission engine fixes - all consistent with benign project maintenance. No evidence of credential exfiltration, hidden network calls, obfuscated code, dependency tampering, CI manipulation, permission broadening, or supply-chain abuse was found in any hydrated patch. The contributor's activity is concentrated in a single repository with coherent technical focus, and the cross-repo list comprises forks of the same project. The high PR velocity appears to reflect active, legitimate development rather than a malicious burst. Investigator 2/3: Investigator 2 reviewed 33 PRs for contributor matthewevans, with 10 hydrated (full or preview patches) and 23 metadata-only. Every visible patch shows legitimate, high-quality development on the Magic: The Gathering engine/game client phase-rs/phase. The contributor is a repo MEMBER with zero unsolicited cross-repo PRs. Fully reviewed patches include: engine parser fixes with extensive CR (comprehensive rules) citations and tests (PR 7034, 7003); UI component refactoring with React hooks and test coverage (PR 7040); diagnostics/tooling changes scoped to AI perf baselines (PR 7013, 7027); automated card-data catalog refreshes (PR 6995); and changelog metadata updates (PR 7010). No evidence of credential exfiltration, hidden network calls, dependency tampering, CI abuse, obfuscated code, permission broadening, or supply-chain targeting was found in any visible patch. The contributor’s activity is tightly focused on a single repository family (phase-rs/phase and personal forks), consistent with a core maintainer rather than a spray-and-pray attacker. Confidence is medium rather than high because 23 PRs in this shard were metadata-only and several preview patches were truncated; however, the hydrated evidence that was available is unequivocally clean. Investigator 3/3: Investigator 3 shard reviewed 33 PRs. Five PRs carried full or partially visible patches covering engine payment/trigger fixes, parser fail-closed guards, server undo/rewind, and automated data refreshes. All inspected patches are well-documented, tied to MTG Comprehensive Rules citations, covered by tests, and show no evidence of credential exfiltration, hidden network calls, obfuscated code, dependency abuse, CI tampering, or permission broadening. Author association is MEMBER on phase-rs/phase; activity is concentrated on a single project with no anomalous cross-repo burst. Twenty-three PRs were metadata-only and five preview patches were truncated, so confidence is medium rather than high due to the 70 omitted PRs. Patch-level safety guard downgraded the result to caution: 70 PRs were metadata-only after compact hydration.