fix: enforce trusted producer policy atomically

[briananderson1222]

Outcome

Flow now enforces .flow/config.json trusted producer and authority-trace pins inside canonical evaluateRun processing while the run mutation lock is held. Hosts no longer need an unsafe pre-filter or a check-then-evaluate workaround.

Closes #143.
Related consumer: kontourai/station#290.

Contract

• pinned claim evidence only satisfies a gate through an allowed producer or authority trace
• unattributed evidence is rejected when a producer pin exists
• expectation-level arrays override claim-type mappings, including explicit empty arrays
• rejected evidence retains untrusted_producer / authority_gap diagnostics even when another trusted artifact satisfies the gate
• concurrent attachment/evaluation remains serialized by Flow's canonical mutation lock

Verification

• npm test — PASS: 278 Node tests; console smoke; browser 25 passed / 7 intentional skips
• npm run docs:check — PASS
• focused producer-policy suite — PASS: 17/17
• npm run typecheck — PASS (independent review)
• npm run check:types:contracts — PASS
• git diff --check — PASS
• independent code review — PASS after mixed trusted/untrusted diagnostic fix
• independent acceptance verification — PASS, all Enforce trusted producer pins inside mutation-safe Flow evaluation #143 criteria and goal fit

Boundary

This PR does not change Station and does not merge or release Flow. Station #290 must continue pinning the published Flow version until this change is reviewed, merged, and released separately.