test(validation): add cross-repo claim parity scanner

[raylee-hawkins]

Summary\n- clean parity-only replacement from origin/main worktree\n- includes only parity scanner, parity workflow, and parity unit tests\n- workflow remains report-only for PR safety\n\n## Included files\n- .github/workflows/cross-repo-claim-parity.yml\n- scripts/verify_cross_repo_claim_parity.py\n- tests/test_cross_repo_claim_parity.py\n\n## Excluded\n- baseline-validation-contract workflow and validation-factory helper files are intentionally excluded\n\n## Local validation\n- python -B scripts/verify_cross_repo_claim_parity.py --repo-root C:\Raylee\Repo\HawkinsOperations --report-only\n- python -B -m unittest discover -s tests\n- git diff --check\n

[raylee-hawkins]

Post-release classification: DRAFT / REPORT-ONLY GOVERNANCE TOOLING. This PR is not part of Release 001 proof. It remains advisory unless explicitly promoted to enforcement mode in a later PR. Report-only workflow must not fail required checks. No proof ceiling or public claim is promoted.

[raylee-hawkins]

Summary:

• Reviewed PR test(validation): add cross-repo claim parity scanner #39 as report-only governance tooling for cross-repo claim parity drift visibility.
• Scope remains limited to the parity workflow, scanner, and tests.

Changed files:

• .github/workflows/cross-repo-claim-parity.yml
• scripts/verify_cross_repo_claim_parity.py
• tests/test_cross_repo_claim_parity.py

Validation commands and results:

• python -B scripts/verify_cross_repo_claim_parity.py --repo-root C:\Raylee\Repo\HawkinsOperations --report-only: PASS (STATUS=pass; FAIL_COUNT=0; warnings are report-only drift findings)
• python -B -m unittest discover -s tests: PASS (Ran 4 tests, OK)
• git diff --check: PASS

CI status:

• GitHub checks observed green before ready/merge gate: required-files, cross-repo-claim-parity, ho-det-001-proof-loop, public-ho-det-001-controlled-test-report, AWS/HO-DET fixture loops, baseline validation contract, and Security Onion visibility contract all passed.

Report-only boundary:

• Workflow invokes the scanner with --report-only.
• No GitHub branch protection, required check, ruleset, or settings enforcement is changed by this PR.

Claim boundary:

• This PR does not promote Release 001 proof, proof ceiling, public-safe status, runtime status, signal-observed status, or public claims.
• The scanner reports drift; it does not authorize truth, proof, release, or public publication.

Risk assessment:

• Low implementation risk within validation tooling scope.
• Primary residual risk is known drift volume: report-only scanner currently surfaces warnings for later controlled cleanup.

Merge recommendation:

• Merge is reasonable after current gates are reconfirmed: unchanged head SHA, green checks, no unresolved review threads, and Raylee MERGE_APPROVED.