fix: drop evidence entries whose evidence_data serializes away

[olivrg]

Resolves the external review's single blocking finding.

The bug

safeJsonSnapshot uses JSON.parse(JSON.stringify(entry)). When an extracted evidence_data value is a function or symbol, JSON.stringify silently omits that property from the object (it does not throw). The snapshot therefore returns ok: true with evidence_data gone — a structurally malformed entry { evidence_key } missing its required field, which was then sent on /audit.

This was reachable: extractByPath returns found: true for a function/symbol value (it only rejects undefined). The malformed entry would 400 the audit; because audit failures are best-effort and swallowed, a legitimately-executed call would degrade into a missing finalization — surfacing server-side as evaluation_expired, a false tamper/bypass signal.

The fix

After snapshotting, also drop any entry whose evidence_data did not survive the round-trip (=== undefined). Precise, no false drops:

• extractByPath already excludes undefined inputs, and BigInt/circular refs throw (already dropped via the existing catch), so the function/symbol drop was the only path that slipped through.
• A legitimate null value survives the round-trip and is kept.

Verification

pnpm verify green: 198 tests (was 196), 0 type errors, build ✓. New test asserts a function-valued evidence path drops only its own entry while the serializable sibling survives — complementing the existing BigInt (throws) per-entry test.