test(evidence): prototype versioned digest verification for RFC #196

[kaveh8866]

Summary / status

DRAFT / test-only / no production migration. A separate prospective proof-of-concept for RFC #196 and #192. Based on protected main 89cfdcb10ab407f5c1ef84b8cda05894b5dd4a2a.

One new unit-test file tests/unit/observation-digest-profile-prototype.test.ts explores:

• exact frozen legacy top-level-replacer bytes and SHA256 (dedicated profile name; not an alias for legacy-ts-v0);
• candidate semantiq-canonical-json-v1 nested evidence sensitivity using the already implemented shared canonicalizer;
• exclusion of evidenceDigest from its subject and explicitly handled optional interpretation;
• deterministic object key ordering vs order-sensitive arrays;
• explicit-profile verification, malformed/absent/unknown profile refusal, and rejection of unsupported nested values.

Not implemented: active new-ObservationEvidence producer, schema or profile registry changes, privacy/redaction policy, cross-language evidence-verifier parity, historical rehash, or any migration of public evidence. The test-only projection is intentionally incomplete and cannot be treated as a canonical artifact contract. The RFC must be approved before any Core or production behavior change.

Governance

• Fast-path bounded isolated fixtures; no runtime code or third-party code copied
• Core RFC RFC(DRAFT): versioned ObservationEvidence digest and safe legacy verification #196 accepted for implementation
• Exact-head GitHub Actions CI, Documentation Site and Security completed successfully for c97b42f636539d0ab03dcd04b6bfdafde22e9306 (CI run 38089437571); CODEOWNER approval is still pending
• Full caller/verifier impact and sensitive-field policy resolved
• Protected main unchanged by this PR
• Observed ≠ Inferred, integrity ≠ truth; no new external performance/security claims.

Related: characterization Draft PR #195; roadmap #177, #188, #192.