Milestone 6: evidence integrity and deterministic replay

[anthfuller]

Summary

• add standalone canonical evidence-integrity verification
• add exact deterministic replay for permit and fail-closed denial outcomes
• bind approval and decision evidence to a versioned policy-bundle digest covering metadata and exact executable Rego bytes
• verify the policy bundle before invoking OPA
• enforce complete ordered audit correlation and safe replay output handling
• document replay, integrity, and provenance limitations without claiming signatures or external attestation

Validation

• reviewed head: 4a9414cd55c8abdd3f66432ce8910e4d752b9a20
• tree: 9e79f784c7de013406eb72ec3770a69b4e291a3a
• 82 tests passed
• OPA 1.20.2 strict validation passed
• prompt, policy, allowlist, settings, and contract validators passed
• evidence generation, verification, and deterministic replay passed
• golden dataset: 4 scenarios, 1.00 success rate
• Markdown links/fences, workflow YAML, whitespace, and whitepaper integrity passed

Do not merge until GitHub Actions passes against the reviewed head and final independent review approves the PR.