refactor(evidence): consolidate bundle inventory producers

[doublewhy]

Context

• The generic offline verifier is introduced by feat(cli): verify offline evidence bundle integrity #93.
• Existing evidence producers already emit the same four-field inventory entry shape.
• This is internal plumbing: RAES remains the semantic authority and backend meaning remains backend-local.

Problem

• Producers duplicate byte-level path, media-type, size, and SHA-256 inventory logic.
• Backend verification can perform semantic checks without first proving generic bundle integrity.
• Refactoring without parity coverage could silently change existing inventory bytes or compatibility entry points.

Fix

• Add shared private inventory primitives and retain existing producer compatibility wrappers.
• Preserve byte-for-byte inventory output for unchanged inputs.
• Run generic offline integrity verification before existing backend-specific semantic verification.
• Keep aggregate/tier recomputation, privacy scanning, and all semantic claims in their backend modules.

Acceptance

• Existing inventory bytes and compatibility wrappers remain stable.
• Generic integrity runs first and tampering fails before backend semantic checks.
• Shared primitives import no simulator and define no schema or semantic authority.
• Targeted parity, tamper, lint, type, policy, installed-distribution, and canonical verification checks pass.
• Draft feat(cyberbattlesim): add baseline reproduction evidence #82 is not merged as part of this work; its branch remains preserved and broader CyberBattleSim remediation stays under fix(cyberbattlesim): reconcile SDL evidence requirements, simulator capture, and backend manifest #86/#1112.