[cschanhniem]

Implements I5 from NEXT_100_PR_MAP: cross-repo evidence traceability.

What

• src/openamp_foundry/evidence/cross_repo_traceability.py: CRT- schema
• VALID_REPO_TYPES (6): primary, fork, mirror, partner_lab, independent_replication, downstream_consumer
• VALID_ARTIFACT_TYPES (8), VALID_TRACEABILITY_STATUSES (5), VALID_LINK_CONFIDENCE_LEVELS (4)
• CrossRepoArtifactRef (8 fields), CrossRepoTraceabilityRecord (8 fields)
• 10 validation rules: prefix, primary artifact id/type, status, total_repos count, dry_lab_only, note, ref artifact_id/type, https URL, repo_type, commit_sha, confidence_level
• format includes ✓ for verified refs, ? for unverified
• 63 tests; BASELINE 8347→8410

Why

Multi-lab reproducibility requires linking the same artifact ID appearing in two repos. CRT- records create an auditable chain: if partner lab X runs OpenAMP pipeline on the same candidates, their CERT- IDs can be linked to ours without either repo needing to read the other's private data.

Disconfirming pass

• dry_lab_only=False blocked
• Non-https repo URLs blocked
• Unknown artifact types blocked on both primary and refs
• Empty commit_sha blocked (prevents un-pinned references)
• total_repos mismatch blocked