docs: add ephemeral cloud forensic evidence gates

[catcherintheroad-hub]

Created from review issue: #1395

Summary

• Add ephemeral cloud workload evidence gates to forensics-checklist
• Cover Kubernetes, managed containers, and serverless evidence that can disappear before traditional cloud snapshots are useful
• Add an edge-case fixture for evicted pods, mutable serverless aliases, mutable container image tags, and complete evidence records

Validation

• git diff --check
• Markdown fence balance and ASCII check for touched files
• Reference URL checks for NIST SP 800-86, RFC 3227, Kubernetes Pods, and AWS Lambda versions