fix(corpus): make hosted evidence reproducible

[Tom409114]

What changed

• selects immutable root-eligible repositories from two popularity strata with bounded, validated GitHub API use
• records candidate and selected-sample provenance, exact root blob evidence, request counts, exclusions, hashes, runtime, limits, and a copyable replay contract
• treats truncated trees and repository failures as explicit exclusions/failures instead of silently promoting incomplete scans
• keeps findings source-free while preserving stable IDs and immutable source URLs
• hardens replay against dirty worktrees, hidden index state, Git hooks/filters/fsmonitor, redirected Git state, input collisions, evidence mutation, stale dependencies, runtime drift, and token leakage
• verifies raw tracked bytes/modes/OIDs, exact index/tree equality, evidence SHA-256 before and after install, and a fresh exact-HEAD checkout supplied by the caller

Verification

• 59 test files: 968 passed, 7 skipped
• TypeScript typecheck
• Biome: 177 files, no warnings
• actionlint
• build
• rules, schemas, and README demo generators
• README parity and generated-artifact cleanliness
• git diff --check
• two independent final reviews: Ready, no Critical/Important/Minor findings

Safety

This PR does not publish npm, create tags/releases, or merge release PR #66. It only hardens the read-only corpus evidence workflow.