Core v2: Add corrective evidence-identity generation

[yihanzhu]

Summary

• Add one complete, unselected core v2 generation.
• Require passed evidence to match the exact selected execution projection.
• Keep all-non-passing incident observations valid.
• Append the generation registry and rebind existing selected-generation consumers to the enlarged registry without changing the stable wrapper.

Scope

Tracks Roadmap item 4 and the unresolved Important finding on PR #222. This is the first of two authorized correction PRs. It does not switch the selected generation; the atomic cutover is a separate PR after this merge receipt exists.

Adoption record: #222 (comment)
Review finding: #222 (comment)

Safety

Everything remains inactive, repo-only, offline, and restorable. No credential, target, release, install, profile activation, deployment, permission, or external write is added. Historical generations are unchanged.

Targeted proof

• evidence-identity matrix: 29/29
• portable-core schema: 47 owned rules, 141 direct cases, 13 private routes, 8 registry cases, 41 activation guards, 8 numeric boundaries, 8 review findings, 44 legacy assertions; zero failures
• fake-forge matrix: 45/45
• affected control suites: credential 45, duty 56, evidence integrity 75, kill switch 37, risk gates 48, sandbox 46, roll-up 23
• affected default adapters, resolver, scanner, and reconciliation tests passed
• ShellCheck 0.11.0, bash syntax, manifest, rename, and diff checks passed

The branch merged the docs-only main advance normally. It was not rebased or force-pushed.

[yihanzhu]

Codex reviewer (cross-vendor, read-only)

Reviewed-head: 2ed27b1
Reviewed-base: 2445b5e
reviewer: operator-default @ high

Posted verbatim by codex-review.sh (codex exec review --json --base refs/codex-review/225-67127/base in an isolated temp worktree, sandbox forced read-only). Comments only — Codex never pushes, approves, or merges.

The corrective generation consistently binds passed evidence to the selected execution projection while preserving non-passing incident evidence. Registry, package identities, dependent references, documentation, and focused tests appear synchronized.