refactor(evidence): share inventory producer primitives

[doublewhy]

Plain-language summary

• Context: feat(cli): verify offline evidence bundle integrity #93 introduces a generic offline integrity verifier, while existing CLI and CybORG producers already emit the same four-field inventory entries.
• Problem: Producers duplicated byte-level inventory mechanics, and CybORG semantic verification did not first prove generic transitive integrity.
• Fix: Add private simulator-free inventory primitives, preserve producer wrappers and exact bytes, and run generic integrity before backend-local semantic recomputation.

Issues closed

Closes #94

Verification

• Focused inventory, generic-verifier, and CybORG reproduction suite: 67 passed.
• Exact canonical JSON bytes and legacy media types are frozen for both current producer wrappers.
• Generic tamper rejection is proven to occur before backend semantic parsing.
• Ruff formatting/checks passed; strict mypy passed across 87 source files.
• Repository policy, REP-005 requirement governance, identity policy, ADR immutability, 40 tooling tests, and all five optional-extra typecheck lanes passed under Python 3.12.
• The macOS ARM canonical base lane reached 491 passed / 21 skipped, then reproduced an existing parent-branch CybORG source-snapshot test failure; the same test fails unchanged on feat(cli): verify offline evidence bundle integrity #93. Authoritative Ubuntu CI remains required after retargeting.
• git diff --check passed.

Merge order

• Stacked on feat(cli): verify offline evidence bundle integrity #93; GitHub therefore shows this PR against branch 92-REP-005-offline-bundle-verifier.
• Merge feat(cli): verify offline evidence bundle integrity #93 first.
• After feat(cli): verify offline evidence bundle integrity #93 lands, retarget this PR to dev, update it from the merged base, and rerun the complete Ubuntu verification graph.
• Draft feat(cyberbattlesim): add baseline reproduction evidence #82 remains open and its branch is preserved; close it unmerged only after this replacement lands and parity is confirmed.
• Do not merge or enable auto-merge before the prerequisite and required checks are satisfied.

ADR boundary

ADR-002 permits shared mechanical plumbing but keeps RAES and backend modules authoritative. The new private module imports no simulator or RAES contract and defines no schema, protocol, aggregate, privacy rule, semantic check, or scientific claim. ADR-003's single-distribution boundary remains unchanged.