evidence: mint source-snapshot receipt identity inside Evidence #528

Finding

PR #527 correctly moved source-snapshot binding into evidence_core, but SourceSnapshotReceiptV1::from_source_artifact still accepts a caller-supplied receipt_id: EvidenceId.

That leaves receipt-record identity outside the Evidence aggregate boundary. A caller can reuse the same UUIDv7 for two receipts that bind different SourceArtifact identities/content. The current public contract test does exactly that for equal-content artifacts. The canonical receipt digests differ, but receipt_id no longer uniquely names one immutable receipt record.

Existing Evidence aggregates (SourceArtifact, DocumentRecord) mint their own EvidenceId on creation and only accept persisted IDs on wire reconstruction. SourceSnapshotReceiptV1 should preserve that boundary.

Required RED

On current #527, construct two receipts through the public creation API and require distinct receipt identities even when all caller-controlled semantic inputs except source-artifact identity are equal. A caller must not be able to choose/reuse the receipt UUID.

Causal repair

• remove receipt_id from the public from_source_artifact constructor;
• mint EvidenceId::new() inside Evidence;
• keep wire deserialization capable of reconstructing and validating the persisted UUIDv7;
• retain source_artifact_id and content digest as separate dimensions;
• keep receipt binding SHA-256 dependent on the minted receipt identity;
• update public tests so receipt identity uniqueness is asserted without weakening canonical UUID/wire refusal coverage.

No Projection authority, Rubin arithmetic, or production approval registry change belongs here. This is a #527 foundation repair and should remain Draft until exact-head gates/review complete.