Bind execution evidence to observed runs

[aantenore]

What changed

• introduce Execution Passport v2 with strict run-bound, observation-only evidence bindings
• add an executable StageFabric adapter that verifies schema, trace semantics, producer seal, timestamp grammar, exact canonical JSON plus LF encoding, and artifact digest
• retain read-only validation of archived v1 passports
• add a real StageFabric golden artifact, CLI workflow, package-consumer coverage, and malformed UTF-8 rejection

Why

Placement evidence was content-free but could be replayed onto another run and did not carry an enforceable chronology or authority ceiling. V2 binds each observation to the canonical run identifier and makes placement explicitly non-authoritative.

Impact

Consumers can package verifiable placement lineage without embedding provider content. Existing v1 statements remain validatable, while new creation emits v2.

Validation

• npm run release:check
• 91 tests; 92.29% statement coverage
• production audit: 0 vulnerabilities
• publint and package consumer smoke
• repository identity and forbidden-literal audit across all refs