docs: readiness evidence-chain audit

[Jammy2211]

Summary

Audit deliverable for #83 (build-chain campaign PyAutoBuild#155, Phase 2): docs/readiness_evidence_audit.md — the per-leg evidence map behind the readiness verdict, three measured integrity findings, the resolution of the missing-dataset question, and the judgment on what GREEN is worth today. Docs only — no behaviour change; the fix PRs (test_run entrypoint wiring, verify_install exercise run, surface-definition recording, version_skew floor rework, HowTo* simulator stage) each follow behind their own plan.

Headline findings (all measured, commands/timestamps in the doc):

• test_run's server-first cloud path is unreachable from every real entrypoint (main() always passes results_dir → fetch_cloud=False); the leg runs on the 2026-07-09 local surface while newer cloud runs exist.
• version_skew is structurally unfailable by releases (8/8 MATCH on comparands #120 froze); the invariant that matters now — floors name installable versions — is guarded by nothing.
• verify_install has never been satisfied post-PR#77 (fix merged 13:08Z; the day's only ingest ran 10:29Z, pre-merge; artifact absent).
• Finding 3 resolved: the HowTo* smoke surface passed for months on datasets releases had force-committed (purged #151, 2026-07-13); the tutorials never simulated for themselves. Pre-existing falsehood newly revealed, not a regression.
• Verdict-worth judgment: the gate holds partly by paralysis — it cannot wrongly GREEN today (degraded legs fail safe) but can barely GREEN at all; recommendation on the nightly grant is in §4.

Shipped under the human-authorized corrective-PR exception for Heart RED (standing this session). PR-open only; merge stays human.

API Changes

None — documentation only.

Test Plan

• PyAutoHeart suite run in the worktree (gate leg).
• Every finding carries its establishing command or timestamp pair; the doc's "Trust nothing here" discloses this audit's own caught instrument error.

Generated by the PyAutoLabs agent workflow.