fix(receipt): require complete evidence for VERIFIED receipts

[abrichr]

Summary

• revalidate the complete typed run report before issuing a shareable receipt
• require exact authorization, identity, postcondition, per-step effect, transaction-journal, and resolved-delivery coverage
• refuse unarmed, reconciled, approved-unverified, swapped, ambiguous, or unaccounted consequential evidence
• name the builder version honestly and version the changed receipt contract as openadapt.run-receipt/v2

Local verification

• 61 focused receipt tests
• 81 consistency/release/claims tests
• 10 real free-path E2E tests
• Ruff + format + mypy (217 files)
• wheel/sdist build and distribution license-boundary validation

No release is requested or authorized by this PR.