Core v2: Select corrective evidence generation

[yihanzhu]

Summary

• Atomically select the corrective core v2 evidence-identity generation.
• Rebind the stable wrapper, inactive resolver, Control package closure, and state scanner to the same generation.
• Bind resolver provenance to PR Core v2: Add corrective evidence-identity generation #225 merge 6a9904e6fc3eb70b76e92f3c2f5a37d5a4bf3edf and publisher receipt 00bd57c0dc3aa6e29bd123c14a18850ffd3432b4a32a6177a86eff6532792d78.
• Keep both historical generation trees byte-for-byte unchanged.

Scope

Tracks Roadmap item 4 and completes the second of the two authorized core correction PRs for the unresolved Important finding on PR #222. This PR changes selection and synchronized immutable references only; it adds no new capability or implementation path.

Safety

Everything remains inactive, repo-only, offline, and restorable. No credential, target, release, install, live profile activation, deployment, permission, or external write is added.

Targeted proof

• evidence-identity matrix: 29/29
• prior fake-forge generation and wrapper compatibility: 45/45
• portable-core schema: 47 owned rules, 141 direct cases, 13 private routes, 8 registry cases, 41 activation guards, 8 numeric boundaries, 8 review findings, 44 legacy assertions; zero failures
• Control roll-up: 23/23
• Control suites: duty 56, credential 45, evidence integrity 75, risk gates 48, kill switch 37, sandbox 46
• profile resolver: 47/47
• state scanner: 38/38
• affected default adapters, CI payload, and reconciliation tests passed
• ShellCheck 0.11.0, bash syntax, canonical JSON, rename, diff, and immutable-generation checks passed

[yihanzhu]

Codex reviewer (cross-vendor, read-only)

Reviewed-head: 404e189
Reviewed-base: 6a9904e
reviewer: operator-default @ high

Posted verbatim by codex-review.sh (codex exec review --json --base refs/codex-review/226-80913/base in an isolated temp worktree, sandbox forced read-only). Comments only — Codex never pushes, approves, or merges.

The generation cutover is applied consistently across the wrapper, resolver, Control closure, scanner, documentation, and tests. Updated hashes and references match the selected corrective generation and modified artifacts.