feat: reproducibility tests — Phase 2 benchmark honesty - #9

Phase 2: Reproducibility — rankings from same inputs must be reproducible.

- Update schemas/run_manifest.schema.json: add generated_at and input_hashes
  as required fields (previously absent from schema but present in output)
- Add test_reproducibility.py: 18 tests verifying:
  - Two independent runs produce identical JSONL ranking order
  - Two runs produce identical scores for every candidate
  - Two runs produce identical selected candidate set
  - run_manifest.json is generated alongside ranked.jsonl
  - Explicit manifest_path argument is respected
  - Manifest validates against updated JSON Schema
  - All required fields present (run_id, pipeline_version, config_hash,
    generated_at, inputs, input_hashes, outputs)
  - pipeline_version in manifest matches installed package __version__
  - run_id is valid UUID format
  - Two runs produce different run_ids (unique per run)
  - SHA-256 hashes in manifest match actual files
  - Candidate and reference paths recorded in manifest
  - stable_json_hash() is deterministic for same config
  - stable_json_hash() changes when config changes
  - build_run_manifest() produces correct structure
  - SHA-256 output is 64-char lowercase hex
  - Different file content → different SHA-256
  - file_sha256() matches stdlib hashlib computation
- Add recall_at_k, enrichment_factor, benchmark_summary to evaluate.py
- Fix ruff F401/E741 issues across pipeline.py, test_cli.py, test_pipeline_filters.py
- 55 tests passing, ruff clean