C4 follow-up #4: add message_does_not_contain_substring assertion kind + pin C4 invariants

Closes the fourth ask from the C4 cross-review (docs/proposals/C4-followup.md
Item 4). The eval harness previously had no way to assert the absence of a
pattern in a trace — only positive `message_contains_substring`. That meant
the C4 "no more node -e / bash+fetch from CEO" invariant was only
demonstrated by the diff between two commits, not by any running assertion
that future regressions would trip.

Three changes:

1. Extend the Assertion union in tests/eval/types.ts with
   `message_does_not_contain_substring` (role + substring). Symmetric to
   the positive kind; fails on first match with a specific reason.

2. Add the case in assertion-judge.ts. Same traversal as the positive
   branch but inverted exit condition.

3. Add two harness self-tests covering pass + fail, so the new kind is
   exercised even when the fixtures directory is empty.

4. Pin two C4-regression assertions onto the recorded ceo-bootstrap-empty
   fixture: the assistant response must NOT contain "node -e" OR
   "/api/companies". Any future regression that reintroduces the
   HTTP-path-in-prompt pattern or the bash+node -e shell fallback will
   now fail pnpm test:eval instead of living in the fixture silently.

typecheck green, test:eval up from 8 → 10 tests (2 new self-tests), all
passing.

tests/eval/types.ts

@@ -107,6 +107,17 @@ export type Assertion =
       role: "assistant" | "user";
       substring: string;
     }
+  | {
+      /**
+       * Negative substring check. Fails when *any* message of `role` contains
+       * `substring`; used to pin post-refactor invariants where a particular
+       * pattern must disappear from the trace (for example, asserting that a
+       * CEO bootstrap no longer emits `node -e` after C4).
+       */
+      kind: "message_does_not_contain_substring";
+      role: "assistant" | "user";
+      substring: string;
+    }
   | {
       kind: "tool_call_arg_matches";
       name: string;