test(evidence): characterize nested normalization digest gap

[kaveh8866]

Summary

Test-only characterization for #192. Adds deterministic, no-network fixtures demonstrating why the legacy JSON.stringify(payload, Object.keys(payload).sort()) preimage can omit nested result/context fields. Contrasts this with SemantIQ's existing canonicalJson and hashCanonical helpers. No production normalization digest, schema, adapter, secret handling, or historical artifacts are changed.

Contribution path

• Fast path: bounded nonsemantic unit tests, no public contract change.
• Core path: reserved for any eventual production digest migration or source-normalizer repair.

Evidence and limits

• Baseline: main at 979cf511e2fc57811fb3cef3766be1653a2e45f5.
• Test file: tests/unit/evidence-digest-characterization.test.ts.
• Four characterization cases authored: lost nested fields, shared canonical preservation, nested key-order stability, and real EvidenceNormalizer.normalize() output with a nested result mutation. The fourth case retains the actual emitted UUID/timestamp rather than mocking them.
• Exact-head GitHub Actions verification at 9d5d025ea0a3bd11916969cc024afae78cb5d700: CI, Documentation Site and Security all completed successfully (GitHub Actions run 38085407462 for CI). The protected-branch merge and CODEOWNER review have not occurred; the GitHub runner executes tests, not a locally witnessed run.
• Do not interpret passing characterization tests as evidence that EvidenceNormalizer.normalize() has been fixed.
• canonicalJson and strict semantiq-canonical-json-v1 have different accepted value domains. Existing canonicalizeV1 rejects floating-point values, undefined, and nonplain objects; do not swap the profile in blindly.
• The normalizer generates random ID/current time. Caller reachability, meaningful impact, PII redaction and historical digest compatibility are still unresolved.

Security, compatibility and governance

• No real environment variables, credentials, private data, external repository code, API access, deployment, release, or protected-branch modifications.
• Product schema remains 1.0.0; software release identity remains 0.1.0-alpha.2.
• Observed != Inferred: this PR proves only a JavaScript preimage omission on frozen examples.
• Required CI/CODEOWNER review is pending; leave as draft and do not merge until reviewed.

Related: #192, #188, #189 and #177.