docs/test(evidence): propose disclosure-scoped ObservationEvidence digest

[kaveh8866]

Phase 4 — RFC #196 disclosure-scope proposal (test + docs only)

DRAFT; NOT APPROVED / NOT IMPLEMENTED / NOT RELEASED. Depends on RFC #196 and #192; follows passing PR #197 head c97b42f636539d0ab03dcd04b6bfdafde22e9306.

What changed

• Docs/evidence/OBSERVATION_DISCLOSURE_DIGEST_SCOPE_PHASE4_PROPOSAL.md: explains observed sensitive-data handling and distinguishes proposed local-raw, internal-sanitized and public-summary evidence without promoting these names to implemented schema contracts. Candidate field matrix, explicit omitted-field list, domain-separated public-summary digest and migration/verification blockers.
• tests/unit/observation-disclosure-scope-prototype.test.ts: five synthetic non-routed test cases proving the semantics of a sample, not claiming real privacy certification. Test-only function explicitly projects a public subset before calling SemantIQ's existing hashCanonical; it does not call or alter the production normalizer.

Key scientific/security boundary

A public-summary digest is NOT whole-execution or full ObservationEvidence integrity. Changes to omitted private command/environment data intentionally do not change the public-summary digest; changing an included exit code does. Public metadata must disclose this difference. No assertion is made that pattern-based redaction of arbitrary raw text is sufficient.

Contribution path / review

• Fast-path proposal/docs and synthetic tests; no changes to runtime, schema, registry, historical digests, migration matrix, provider access or release
• Exact-head CI, Documentation Site and Security workflows completed successfully for cd1153ebd84b7b5c708a8529ba4029dae9368dd4 (CI run 38124057522). CODEOWNER review/approval remains pending
• Core/RFC-approved disclosure contract, provenance and identifier generation
• Privacy/security review on actual consumers/public artifact path
• TS/Python fixture parity on approved future identity (not claimed here)
• RFC RFC(DRAFT): versioned ObservationEvidence digest and safe legacy verification #196 accepted; until then, do not integrate prototype in runtime

Base main: 89cfdcb10ab407f5c1ef84b8cda05894b5dd4a2a. No protected main mutations. No third-party code or user secrets introduced. Related #177, #188, #189, #191, #192, #195, #197.

Review focus: Is creating a distinct public-summary seal warranted? Does the summary reveal only acceptable operational status? Must the publication of timing/identifiers be prohibited until an authorized policy exists? Where should internal-sanitized proof live?