fix: enforce the public source artifact boundary

[abrichr]

What changed

• Removes deployment-derived identity/reliability corpora, tuned evaluation material, and target-specific recipes from the public source and package boundary while retaining public runtime mechanisms, fake-patient demos, bounded aggregates, and reusable harnesses.
• Adds a reviewed path-and-SHA-256 inventory for public data, evidence, static, model, and configuration payloads.
• Validates current source plus embedded wheel/sdist inventories and rejects neutral renames, nested private paths, nested build/dist payloads, special files, unknown artifacts, tampering, and divergent wheel/sdist manifests.
• Validates recovery builds against the target ref's embedded historical manifest under current policy instead of comparing old payloads with current-main hashes.
• Corrects the paper's evidence contract and documents the already-public-history boundary.
• Adds a corpus-free identity-rate scoring interface.

Why

The earlier denylist could be bypassed by neutral filenames and could break publish-existing-ref after legitimate artifact hashes changed. The positive inventory makes payload admission explicit while preserving recovery publication.

The inventory is intentionally payload-file coverage, not general DLP for arbitrary Python, Markdown, or TeX source.

Validation

• 46 release-boundary, identity-rate, and claims tests passed.
• Release source/version consistency, docs consistency, and claims gate passed.
• Paper artifact constants passed; full-report and workshop PDFs built.
• Exact rebased wheel and sdist built and passed embedded/cross-inventory validation.
• Bounded non-e2e suite before the final recovery-only adjustment: 2,606 passed / 30 skipped.
• Fast identity ladder: 22 passed; exact numeric-MRN OCR regression passed.
• One legacy ONNX corpus harness remains pathologically slow locally and did not complete inside a standalone five-minute bound; the changed source-boundary code does not touch its runtime mechanism.