tooling: migrate Tool 0.2.3 evidence correctness

[Kinirin]

Implements the Tool 0.2.3 evidence-correctness work package on top of the immutable 0.2.0-draft normative snapshot.

Scope:

• bump Tool/package to 0.2.3 and bind it to Specification revision 14a0c2f54bb486de6a109979224f998b04fd04a3;
• sync embedded profile schema and registry to that bound snapshot;
• use Python source encoding detection (tokenize.open) so UTF-8 BOM / coding cookies do not degrade inventory/dependency evidence;
• deterministically resolve relative Python imports when package evidence permits;
• separate dependency target scope into PROJECT_COMPONENT, EXTERNAL_DEPENDENCY, PLATFORM, and UNRESOLVED_TARGET without adding architecture classifications;
• preserve dependency provenance and use LOADS for dynamic import relationships;
• derive direct external Python dependency evidence conservatively from project dependency declarations, while preserving declaration parse/read failures as dependency coverage issues;
• resolve GitHub Actions local scripts from effective working-directory and use execution-aware command parsing so arbitrary script-looking strings do not become synthetic INVOKES edges;
• retain explicit unresolved local-script invocations when the command clearly executes a local path but the target cannot be resolved;
• expose declared dependency evaluator state as RAN or BLOCKED, so an empty finding list cannot be mistaken for an evaluator result when evaluation did not run;
• align profile validation with boundaries XOR components, retired PTSIP waiver semantics, component-policy references, and exact Tool binding;
• retain Tool 0.2.2 Human Clarification behavior as a regression constraint.

Deliberate non-goals for this PR:

• no ptsip conform;
• no JS/TS, npm, Go, or extended .NET adapters;
• no Product Artifact inspection adapter;
• no stable diagnostic emission implementation;
• no agent-decision ingestion or external evidence import.

Verification:

• Python 3.11, 3.12, 3.13, and 3.14 CI pass on the latest PR head;
• each matrix job passes editable installation, full pytest, ptsip --version, and ptsip spec;
• regression coverage preserves deterministic Human Clarification and external GitHub-Issue publication behavior;
• Tool 0.2.3 still reports conformance as NOT_EVALUATED because rule-relative coverage and Product Artifact conformance evaluation remain Tool 0.3.0 work.