security: harden public validators and cache custody

[tcconnally]

Summary

• Harden public context/evidence projections against coverage alias conflicts, malformed privacy fields, falsey digest aliases, synthetic references, and overflow inputs.
• Make release-cache results deep-copy isolated and enforce strict validation in direct public runtime/profile constructors.
• Fail closed for malformed DAG edges, advisory values, non-finite confidence, and canonical JSON NaN values.

Verification

• 2587 passed, 6 skipped
• python3 scripts/build.py --check
• python3 scripts/render_claims.py --check
• git diff --check
• Disposable exact-commit negative-control probes: 12/12 passed

Closes #984