Check artifact fingerprints and review a pinned replay pipeline

[matchalatteguy]

What changes

Adds optional SHA-256 artifact checks and a complete, pinned consumer example that connects input validation, execution-assumption comparison, and evidence review without expanding Evidence Gate's core dependencies.

The thirteen-event synthetic fixture has two instruments and multilevel books. Three scenarios produce actual differences in execution. The consumer inspects emitted JSON/CSV/Markdown files, records fingerprints of all four completed exports, and produces a review packet from the configured evidence contract.

An output can name a report field containing its expected digest through sha256_field. Validation hashes files in chunks and fails for missing, malformed, unreadable, or mismatched digests. Outputs without this option retain existing behavior.

Verification

Twelve end-to-end tests cover:

• Successful comparison, deliberately missing CSV, and repair of that same bundle.
• Duplicate input events stopping the workflow before simulation.
• A missing CSV rejecting an otherwise passing metrics envelope.
• Missing future execution evidence blocking approval.
• Refusal to overwrite an existing result directory.
• Header-only CSV and empty or altered JSON/Markdown/input-contract exports failing fingerprint checks.

The core suite covers digest matches, binary files, malformed and missing report fields, read failures, optional-absent outputs, and compatibility with unconfigured contracts. The example has its own lock file and hosted check; the standalone package still has its existing Python matrix, lint, and installed-wheel gates.

Scope and limits

This is a compact integration example, not a new workflow engine. The datasets are synthetic. Approval checks the declared ordering, arithmetic, markout coverage, and promised artifact bytes. Fingerprints trust the producer's report and establish byte integrity, not artifact semantics or source authenticity. They do not authenticate market data or establish trading profitability. Companion sources are pinned to published immutable commits.