feat: Phase 2D — orchestrator, arguments/verdict endpoints, fabric announce

State machine driver + camp allocator + judge-submitted verdicts +
broadcast hook to Fabric announce channel.

internal/orchestrator/
- allocator.go: pure function implementing the 3-camp rule from the
  2026-05-23 design session — for each camp (pro/con/judge), random
  pick from volunteers; backfill unfilled camps from remaining
  unallocated signups if pool is large enough; <3 final → cancel
  with diagnostic reason. rng injected for test determinism.
- allocator_test.go: 7 tests covering empty/insufficient/single-volunteer
  /multi-volunteer-no-dup/backfill/insufficient-backfill/large-pool
  distinctness invariants. All pass.
- ticker.go: scans every 15s (configurable via ORCHESTRATOR_TICK_INTERVAL),
  drives 3 state transitions atomically:
    created → signup_open (post fabric announcement async)
    signup_open → signup_closed | cancelled (run allocator, write camps)
    signup_closed → debating (open round 0)
  debating → completed is driven by the verdict POST handler (the
  implicit "judging" sub-state is captured by the gate
  status==debating AND now>=debate_end_at). Per-topic transitions
  use SELECT FOR UPDATE so concurrent ticker instances are safe.

internal/fabric/announce.go: HTTP client posting to a Guild announce
channel using x-fabric-system-key header (the Phase 1 gate). Wraps
the formatted topic announcement (title/summary/timing/schema). All
4 config fields required to enable; any missing → no-op with log
(orchestrator runs fine without Fabric coupling for dev).

internal/store/{round,camp,argument,verdict}_store.go: CRUD layer
for the remaining v2 entities. CampStore.WriteAllocation accepts a
tx so the orchestrator can wrap allocator+camps+status into one
atomic transition.

internal/httpapi/handlers/arguments.go:
- POST /api/topics/{id}/arguments — agent posts during debate. Gates:
  agent must be in a camp on this topic; status==debating; content
  nonempty and <=32KB; attached to latest open round.
- GET /api/topics/{id}/arguments — full transcript, visibility-gated.

internal/httpapi/handlers/verdict.go:
- POST /api/topics/{id}/verdict — judge submits. Gates: caller==judge
  camp; status==debating AND now>=debate_end_at; verdict valid JSON;
  rationale required. On success: writes verdicts row (unique on
  topic_id → 409 on dup) and flips topic.status to completed.
- GET /api/topics/{id}/verdict — visibility-gated.

config: 5 new env vars — FABRIC_GUILD_BASE_URL,
FABRIC_ANNOUNCE_CHANNEL_ID, FABRIC_SYSTEM_API_KEY,
FABRIC_BOT_BEARER_TOKEN, ORCHESTRATOR_TICK_INTERVAL.

routes.go: wired new handlers — POST signups/arguments/verdict gated
on agent bearer; GET arguments/verdict on optional-auth chain
(public topics readable anonymously).

main.go: instantiates announcer + ticker; ticker.Run in a goroutine
sharing the lifetime ctx.

go vet + gofmt clean; 7/7 allocator tests pass; 12M static binary.

Next: Phase 2E (deploy to t3 with nginx + CF origin cert) or
Phase 2D.5 (SSE stream for live transcript subscribers).

internal/config/config.go

@@ -11,6 +11,7 @@ import (
 	"fmt"
 	"os"
 	"strings"
+	"time"
 )
 
 type Config struct {
@@ -57,23 +58,44 @@ type Config struct {
 	// real JWKS validation.
 	OIDCIssuer   string
 	OIDCClientID string
+
+	// Fabric announce coupling (Phase 2D). All four required to enable;
+	// any empty → announcer becomes a no-op (logs intent, skips post).
+	// This lets the orchestrator run in environments where the Fabric
+	// coupling hasn't been wired yet.
+	FabricGuildBaseURL      string // e.g. https://fabric-api.hangman-lab.top
+	FabricAnnounceChannelID string
+	FabricSystemAPIKey      string // x-fabric-system-key value (env: FABRIC_SYSTEM_API_KEY)
+	FabricBotBearerToken    string // Authorization Bearer for the dialectic-system Fabric user
+
+	// Orchestrator tick interval. 0 / unset → default 15s.
+	OrchestratorTickInterval time.Duration
 }
 
 func LoadFromEnv() (*Config, error) {
 	c := &Config{
-		Mode:               getenv("ENV_MODE", "dev"),
-		HTTPAddr:           getenv("HTTP_ADDR", "0.0.0.0:8090"),
-		CORSAllowOrigins:   splitCSV(getenv("CORS_ALLOW_ORIGINS", "*")),
-		DBHost:             getenv("DB_HOST", "127.0.0.1"),
-		DBPort:             getenv("DB_PORT", "3306"),
-		DBName:             getenv("DB_NAME", "dialectic"),
-		DBUser:             getenv("DB_USER", "dialectic"),
-		DBPassword:         os.Getenv("DB_PASSWORD"),
-		SystemAPIKey:       os.Getenv("SYSTEM_API_KEY"),
-		AgentAPIKeyPepper:  os.Getenv("AGENT_API_KEY_PEPPER"),
-		OIDCDevBypassToken: os.Getenv("OIDC_DEV_BYPASS_TOKEN"),
-		OIDCIssuer:         os.Getenv("OIDC_ISSUER"),
-		OIDCClientID:       os.Getenv("OIDC_CLIENT_ID"),
+		Mode:                    getenv("ENV_MODE", "dev"),
+		HTTPAddr:                getenv("HTTP_ADDR", "0.0.0.0:8090"),
+		CORSAllowOrigins:        splitCSV(getenv("CORS_ALLOW_ORIGINS", "*")),
+		DBHost:                  getenv("DB_HOST", "127.0.0.1"),
+		DBPort:                  getenv("DB_PORT", "3306"),
+		DBName:                  getenv("DB_NAME", "dialectic"),
+		DBUser:                  getenv("DB_USER", "dialectic"),
+		DBPassword:              os.Getenv("DB_PASSWORD"),
+		SystemAPIKey:            os.Getenv("SYSTEM_API_KEY"),
+		AgentAPIKeyPepper:       os.Getenv("AGENT_API_KEY_PEPPER"),
+		OIDCDevBypassToken:      os.Getenv("OIDC_DEV_BYPASS_TOKEN"),
+		OIDCIssuer:              os.Getenv("OIDC_ISSUER"),
+		OIDCClientID:            os.Getenv("OIDC_CLIENT_ID"),
+		FabricGuildBaseURL:      os.Getenv("FABRIC_GUILD_BASE_URL"),
+		FabricAnnounceChannelID: os.Getenv("FABRIC_ANNOUNCE_CHANNEL_ID"),
+		FabricSystemAPIKey:      os.Getenv("FABRIC_SYSTEM_API_KEY"),
+		FabricBotBearerToken:    os.Getenv("FABRIC_BOT_BEARER_TOKEN"),
+	}
+	if d := os.Getenv("ORCHESTRATOR_TICK_INTERVAL"); d != "" {
+		if parsed, err := time.ParseDuration(d); err == nil {
+			c.OrchestratorTickInterval = parsed
+		}
 	}
 
 	if c.Mode != "dev" && c.Mode != "prod" {