Fix selected report reassessment provenance

[rcs2153]

Summary

Fix the selected project-validation report adapter's existing-terminal temporal provenance blocker.

• use a fresh Core-owned evaluation time for every terminal reassessment
• compare V3 current-runtime source, fact, and assessment commitments semantically
• preserve the original durable governance binding and event history
• expose reassessment time only as transient, redacted provenance
• fail closed on current semantic drift without report regeneration or skill replay

Governed phase

• workflow: dg/blocker
• run: run-1786471531593349000-2
• approval: approval/run-1786471531593349000-2/fix-approved
• presentation: presentation/82976575ad0bc7b2
• approval outcome: granted with persisted presentation proof
• close: Completed, 39 events, 1 approval, 0 retries, 0 escalations

Validation

• cargo fmt --all --check
• cargo clippy --workspace --all-targets -- -D warnings
• focused selected-adapter tests: 5 passed
• cargo test -p workflow-cli --test cli: 169 passed
• cargo test --workspace: passed
• npm run check:docs
• git diff --check

Live GitHub, Jira, and DocsCheck probes remained explicitly ignored because opt-in environment flags and live credentials were not supplied. Fixture and injected-provider coverage passed.

Non-goals

No CLI cutover, selected approval envelope, schema change, provider mutation, new persistence, event mutation, reusable reassessment authority, automatic report generation, hosted behavior, or release-posture change.

Next phase

Focused blocker-fix maintainer review. The selected approval adoption envelope remains blocked until that review accepts this fix.