feat: retain verifiable raw evidence

[kiranmagic7]

Implements #16.

• adds schema v2 with stable behavior IDs and bounded raw-line evidence references
• retains mode 0600 raw trace companions and verifies whole-artifact plus line digests
• removes package verdict semantics in favor of reviewRequired and highestReviewLevel
• rejects cross-version comparisons while retaining v1 schemas as historical contracts
• adds tamper, rendering, schema, and hosted integration coverage

Local verification: make check; make build; inert fixture end-to-end; gosec (0 issues); govulncheck (0 reachable); staticcheck (0 findings).

This PR does not release, publish, or merge the project. Gate 13 remains open until hosted checks and review pass.

[kiranmagic7]

Superseded by the consolidated PR #31. This branch is fully contained in the PR #31 history. Closing it to keep one active upgrade review branch. No merge, release, or launch occurred.