fix(security): align ClaimCLPc with CLPc identity source

[boris]

Vulnerability

High-risk divergence between claim eligibility checks and token identity gating.

Previously:

• ClaimCLPc checked verifier source using isVerified(address)
• CLPc enforced identity using isVerifiedChilean(address) on IIdentityRegistry

This split can create inconsistent policy decisions across contracts.

Changes in this PR

• ClaimCLPc now uses IIdentityRegistryView
• claim eligibility check is now isVerifiedChilean(msg.sender)
• added security note with exploit/repro and migration:
  • docs/security/02-claim-registry-divergence.md

How to verify / exploit (old behavior)

1. Deploy CLPc with identity source A.
2. Deploy ClaimCLPc with verifier source B.
3. Mark user verified in source B but not in A.
4. User can pass claim contract check while token policy source differs.

Remediation / migration steps

1. Deploy new ClaimCLPc with same registry used by CLPc.
2. Grant MINTER_ROLE to new claim contract.
3. Revoke MINTER_ROLE from old claim contract.
4. Update dapp/backend to use new claim address.