feat(eval): implement prospective ClinVar freeze controls

[srinivasdrona]

Summary

• add the offline prospective ClinVar freeze/adjudication implementation required by ADR-0020
• enforce closed PRE_DATA approval, exact registration/overlay/source bindings, x64 runtime identity, bounded streamed acquisition, atomic hash-chained freeze records, restart/idempotence and concurrency controls
• preserve separate A0-A6 axes and terminal outcomes PASS, FAIL, NOT_ESTIMABLE, BLOCKED_POLICY, BLOCKED_DATA, and INVALID

Safety boundary

This PR performs no real ClinVar HEAD/GET/download, label or row inspection, benchmark construction, scoring, policy change, or authorization. All transport tests use injected offline fixtures. Actual archive freeze is a separate post-merge execution step.

Review history

• Codex RED contract: 108 focused tests after adversarial hardening
• Sonnet implementation
• Opus final implementation verdict: PASS after path, stream, restart, overlay, timing and concurrency defects were fixed

Validation

• WSL interpreter: /home/sdrona/raptor/bin/python (Python 3.12.3)
• full suite: 1,752 passed, 23 skipped, 0 failed
• targeted prospective/tiered/live-source: PASS
• git diff --check: clean
• working tree: clean
• no network/download/archive/temp artifacts

Scope

Two commits: frozen tests (131465d) and implementation (c74dba1). No data artifact or validation result is produced by this PR.