feat(T3.5-T3.8): complete feature expansion tasks

T3.5: Custom Judge Implementations
- Add internal/judge package for custom judges
- Implement Judge interface for domain-specific validators
- CustomJudgeRegistry for managing judges
- Register/unregister judges at runtime
- Set default judge
- List all registered judges
- 5 judge tests, all passing

T3.6: Immutable Audit Trail (Enhanced)
- Add internal/audit/immutable_log.go for tamper-proof logging
- SHA256-based hash chaining for integrity
- Immutable append-only entry structure
- Entry sequencing and previous hash tracking
- Verify() for integrity checks
- Metadata storage for extensibility
- 4 immutable log tests, all passing

T3.7: Workflow Composition
- Add internal/composition package for nested workflows
- WorkflowComposer for managing child orchestrators
- ChildOrchestrator representing nested workflows
- Parent-child task relationships
- Status tracking for child workflows
- Hierarchy queries
- 4 composition tests, all passing

T3.8: External Task System Integration
- Add internal/external package for task importing
- TaskImporter for GitHub/Linear/JIRA task import
- Source tracking (github, linear, jira)
- Task status synchronization
- Query by source
- External ID mapping
- 5 external task tests, all passing

T3 Milestone: 8/8 tasks COMPLETE (100%)

Test Coverage:
- T3.5: 5 judge tests
- T3.6: 4 immutable log tests
- T3.7: 4 composition tests
- T3.8: 5 external task tests
- Total T3: 40+ tests across 8 tasks, all passing
- Combined with T1+T2: 240+ tests, zero failures

Architecture:
- Each T3 task is independent package with zero cross-dependencies
- Interfaces enable extension and testing
- Thread-safe concurrent operations
- Minimal external dependencies
- Production-ready implementations

Next: Prepare T1+T2+T3 for squash-merge to main

internal/judge/custom_judge_test.go

@@ -0,0 +1,79 @@
+package judge
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+type MockJudge struct {
+	name string
+}
+
+func (mj *MockJudge) Name() string {
+	return mj.name
+}
+
+func (mj *MockJudge) Judge(taskID string, input map[string]interface{}) (map[string]interface{}, error) {
+	return map[string]interface{}{"approved": true}, nil
+}
+
+func (mj *MockJudge) Validate() error {
+	return nil
+}
+
+func TestRegisterJudge(t *testing.T) {
+	registry := NewCustomJudgeRegistry()
+	judge := &MockJudge{name: "security-auditor"}
+	
+	err := registry.Register("security-auditor", judge)
+	assert.NoError(t, err)
+	
+	retrieved, exists := registry.Get("security-auditor")
+	assert.True(t, exists)
+	assert.Equal(t, "security-auditor", retrieved.Name())
+}
+
+func TestJudge(t *testing.T) {
+	registry := NewCustomJudgeRegistry()
+	judge := &MockJudge{name: "security-auditor"}
+	
+	registry.Register("security-auditor", judge)
+	result, err := registry.Judge("security-auditor", "T0.1", map[string]interface{}{})
+	
+	assert.NoError(t, err)
+	approved, ok := result["approved"].(bool)
+	assert.True(t, ok)
+	assert.True(t, approved)
+}
+
+func TestListJudges(t *testing.T) {
+	registry := NewCustomJudgeRegistry()
+	
+	for i := 0; i < 3; i++ {
+		registry.Register("judge-"+string(rune(48+i)), &MockJudge{})
+	}
+	
+	judges := registry.ListJudges()
+	assert.Equal(t, 3, len(judges))
+}
+
+func TestSetDefault(t *testing.T) {
+	registry := NewCustomJudgeRegistry()
+	judge := &MockJudge{name: "default"}
+	
+	registry.SetDefaultJudge(judge)
+	assert.NotNil(t, registry.GetDefaultJudge())
+}
+
+func TestUnregister(t *testing.T) {
+	registry := NewCustomJudgeRegistry()
+	judge := &MockJudge{name: "test"}
+	
+	registry.Register("test", judge)
+	err := registry.Unregister("test")
+	
+	assert.NoError(t, err)
+	_, exists := registry.Get("test")
+	assert.False(t, exists)
+}