Bind outcome evidence to task and attempt identity

[SamCT86]

What changed

• require readback evidence to carry the same task and attempt identity as the mutation being evaluated
• fail closed on wrong-task or wrong-attempt evidence even when the observed post-state matches
• harden the public verifier input contract so missing state values cannot collapse into a false VERIFIED
• require readbackComplete to be an actual boolean instead of accepting truthy strings
• update the synthetic fixture and reviewer-facing proof docs to match executable behavior

Bugs reproduced

1. A matching post-state attributed to a different attempt was previously returned as VERIFIED.
2. A matching post-state attributed to a different task was previously returned as VERIFIED.
3. expectedPostState: undefined plus observedPostState: undefined could compare equal and return VERIFIED.
4. On unmodified main, readbackComplete: "false" was truthy and returned VERIFIED for a matching post-state.

Verification

Exact remote branch head f8f8b684b882ec7e4f9ef5de846e4c8933272de4 verified on STRATO:

• npm test: 10/10 passed
• git diff --check: passed
• changed-file set: exactly 6 intended files

Boundary

This remains a bounded synthetic reference. It demonstrates evidence identity and outcome-state invariants; it does not claim the public code is the private production evaluator or prove universal agent reliability.