feat: offline evidence CLI for agents and CI (v1.23.0)

[alloevil]

Direction

Make the existing evidence rules usable by agents/local automation without a browser, a server or a model judge. No new rule implementation or runtime dependency.

Changes

• Add inspect --platform omp|codex|claude-code FILE with minimized versioned JSON or text.
• Read one stable regular UTF-8 JSONL input, capped at 64 MiB; fail explicitly on invalid/changed input or known normalization loss.
• Keep raw logs/arguments/paths/IDs/notes out of reports; include input/rule/adapter hashes and original physical source lines.
• Exit 0 means complete report, never task success; optional --fail-on pending-failures uses exit 2; input/coverage errors use 1.
• Generate and package CommonJS rules from UI TypeScript; add a CI drift check. Existing UI rules and web behavior unchanged.

Verification

• 332 tests pass, including 19 new CLI cases: privacy, no-network/server imports, read-only HOME/input, deterministic output, error policy, mixed/multi-result coverage gaps and UI parity.
• 15 frozen real sessions / 2024 tool results match UI summaries; 2493 references verified; no raw evaluation data included.
• Actual tarball inspect works without node_modules or frontend source/compiler.
• UI build, lint (existing findings unchanged), actionlint, 16 automated claims and documentation targets pass.
• Staged source secret scan passes; private output is not committed.

Scope

No databases/compressed files/recursive session discovery, no automatic remediation or coverage verdict. Reports are minimized, not guaranteed anonymous. Follow the existing protected release workflow after CI.