Issue 509 — Add immutable DepMap report evidence contract

[rsolerortuno]

Summary

Implements Issue 509: Immutable DepMap report evidence contract.

• adds immutable DependencyReportEvidence;
• adds deterministic evidence identity and canonical serialization;
• supports available and not_available profiles;
• preserves release, configuration, closure, context and gene identities;
• validates coverage, missingness and integration invariants;
• preserves baseline ranks as read-only observed values;
• rejects production activation and emitted authorization;
• requires human review;
• rejects local-path leakage;
• performs no file I/O, network access or matrix loading.

Scientific boundaries

• no scores are created or modified;
• no ranks are recalculated or mutated;
• the productive baseline remains unchanged;
• production activation remains disabled;
• human review remains mandatory;
• DepMap dependency is not treated as clinical anti-PD-1 response evidence;
• no renderer or report integration is included.

Validation

• Issue 509 contract tests passed;
• existing DepMap contract, snapshot and documentation tests passed;
• full repository suite passed;
• AGY adversarial audit completed;
• Claude review approved;
• git diff --check passed.

Rendering remains deferred to Issue 510.