feat: bind non-live evidence to runtime identity

[Pigbibi]

Summary

• add an immutable, platform/channel-scoped non-live evidence binding contract
• bind P4 receipts to the exact release config, risk, evidence, plugin, and adapter digests
• add a verified paired-shadow helper, runtime-report attachment, tests, and Chinese operator contract

Safety

• no broker SDK, account identifier, credential, runtime-target write, deployment, order, or Live authority path
• runtime scope is stored only as an opaque SHA-256 digest

Verification

• ..................... [100%]
  21 passed in 0.21s (21 passed)

The generic contract supports strategy, portfolio, and plugin-composite candidates; Paper evidence remains a future adapter-owned verified schema, while current paired Shadow has an exact helper.