test: enforce evidence provenance boundaries

[Teakowa]

Summary

• Enforces pinned upstream provenance for pinned-oracle and real-project compatibility evidence.
• Extends project fixtures through semantic and HIR validation while preserving full-project and minimized evidence layers.
• Documents the provenance gate without copying canonical Workshop ownership.

Validation

• cargo build --all-targets
• cargo test --all-targets
• cargo test --test matrix
• cargo test --test corpus
• Compatibility report: 100 fixtures, 96 matched, 2 known gaps, 2 inconclusive, 0 unexpected regressions.
• rustfmt --edition 2024 --check src/compatibility.rs
• git diff --check

Partial implementation of #26; AC5/AC6 remain dependent on workshop-rs#10.
Related to #8