Add M2 ecosystem and framework coverage

[xeonvs]

Summary

• add bounded static ecosystem and framework evidence for Jinja2, Go web frameworks, Symfony/Twig, and React/TypeScript
• make Jinja and Twig configuration templates reviewable through explicit synthetic rules while preserving excludes
• expose scoped completeness and redacted base/head framework/template deltas through the existing read-only evidence MCP
• organize normalized source adapters under evidence.ecosystems and framework providers under evidence.frameworks without runtime discovery or legacy shims
• make stable release recovery idempotent and qualify checksum-pinned OCR 1.9.2

Validation

• scripts/quality.sh check
• full independent tests on Python 3.12, 3.13, and 3.14
• complete-range Gitleaks, privacy, signature, dependency-audit, ShellCheck, YAML, and compatibility gates
• reproducible target-version wheel/sdist plus hash-locked supported-Python installs
• installed-artifact stdio MCP protocol E2E with facts, coverage, deltas, and root-component filters
• checksum-qualified OCR rules preview for .j2, .jinja2, .twig, and extensionless conventional role templates
• two owner-authorized local OCR review/remediation cycles with posting disabled and private artifacts
• user-visible changes have Towncrier fragments
• examples and fixtures are synthetic
• no credentials, private hosts, paths, or provider payloads are included

Security and compatibility impact

Plugins consume only bounded immutable normalized evidence and cannot access Git, the filesystem, subprocesses, network, mutation, or MCP lifecycle. Provider results are bounded and admitted atomically; persisted plugin data is re-redacted and revalidated. The existing ocr_toolkit_evidence server remains the single read-only MCP surface.

For unreleased 0.5.0 component semantics, . is the repository root and repository is an ordinary top-level path; facts, coverage, deltas, filters, tests, and documentation use that contract consistently. Removed flat internal parser/framework modules have no compatibility shims. Runtime dependencies remain zero.

Issues #76 and #78 remain open until stable 0.5.0 registry, provenance, tag, immutable Release, receipt, and supported-Python readback complete.