feat: publish network audit evidence contract

[intel352]

Summary

• adds compute-core network audit evidence DTOs, strict protobuf schema, descriptor artifact, and field-lock metadata
• adds projection/ref/lifecycle/legacy classification helpers for workflow-compute to consume without raw-output fallbacks
• publishes a descriptor-only compute.network_audit_evidence.v1 message contract and CI/release-candidate gates pinned to wfctl v0.64.7

Verification

• ./scripts/check-proto.sh
• ./scripts/check-workflow-engine-load.sh --mode public --wfctl-version v0.64.7
• ./scripts/check-wfctl-action-pin.sh --workflow .github/workflows/ci.yml --workflow .github/workflows/release.yml --workflow .github/workflows/release-candidate.yml --wfctl-version v0.64.7
• GOWORK=off go build ./...
• GOWORK=off go test ./... -race -count=1
• GOWORK=off go vet ./...
• git diff --check
• git diff --exit-code -- proto protocol/pb descriptors

Adversarial review

Subagent adversarial review found release archive omission, invalid projected IDs, partial HMAC binding, permissive lifecycle refs, and public-mode wfctl contamination risks. All Critical findings were fixed before this PR.

Plan note

Per the locked network-audit evidence extraction plan, this PR should remain unmerged until release-candidate and downstream local validation both pass.

[intel352]

Candidate validation evidence:

• Candidate commit: 5104c1f
• Candidate tree: e27876b5cc461f3f148b939091f23432ee2db67f
• Release-candidate workflow run: https://github.com/GoCodeAlone/workflow-plugin-compute-core/actions/runs/26498435442
• Release-candidate result: passed (check-proto, public wfctl v0.64.7 contract validation, build, race tests, vet, GoReleaser snapshot)

Per the locked plan, leaving this PR unmerged until downstream workflow-compute and workflow-compute-scenarios candidate harness validation complete.