Verify retained production acceptance evidence

[abrichr]

What changed

• Add a strict verifier for the Cloud production-acceptance certificate, GitHub provenance, immutable-retention receipt, signed qualification admission, and complete qualification campaign.
• Recompute the admission, runtime-validation, workflow-version, organization, workflow, campaign, contract, outcomes, oracle, and trial-count bindings.
• Reject unknown or revoked admission signers, changed issuer scope, collapsed admission and runtime identities, incomplete trial rows, silent incorrect success, and over-halt omissions.
• Keep the private import path disabled until one approved export contract binds the complete payload, destination, encryption key, immutable retention, importer workflow and ref, and approval authority.

Why

The public acceptance record contains only remote-safe digests, bounded counts, and signer provenance. Evals must not trust those counts or let the evidence authorize itself. It must derive the result from the complete retained campaign under an external trust root.

This is a stacked draft on PR #286. It contains only the verifier delta above codex/production-evidence-contract.

Validation

• 127 focused tests pass.
• Ruff passes.
• git diff --check passes.
• A broader run had 2266 passes and 65 skips. Three sandbox-only log-write tests passed outside the sandbox. Seven pre-existing optional-state tests still require openadapt_ml or local demo fixtures.

Current boundary

No private export is enabled. The importer fails closed before it reads an admission or campaign until the exact export contract receives approval.