Add ephemeral cloud workload forensic gates

[jddark62]

Summary

• add ephemeral cloud workload evidence gates to forensics-checklist
• require immutable Kubernetes pod, managed container, serverless, and build/runtime worker evidence before accepting snapshots or provider audit logs as complete
• add FORENSICS-EPHEMERAL-01 through FORENSICS-EPHEMERAL-07 checks for pod specs/events/logs, current and previous container logs, image digests, serverless function versions/package hashes, workload-to-control-plane correlation, snapshot-only overclaims, and Not Evaluable handling
• add an Ephemeral Workload Evidence output matrix and common pitfall for mutable tags, aliases, $LATEST, task family names, service names, and serverless routes
• add six YAML fixtures covering evicted pods, complete pod preservation, Lambda alias-only evidence, complete Cloud Run revision evidence, ECS latest tag evidence, and expired ephemeral runner evidence

Validation

• git diff --check
• parsed all 6 YAML fixture blocks with Ruby YAML.safe_load
• verified Markdown fence balance for SKILL.md and the fixture file
• marker scan confirmed FORENSICS-EPHEMERAL-*, output matrix, and version history
• privacy scan found no local user/path/email strings in changed files

Closes #1395

Bounty target: Improver Moderate if accepted.

Bounty Info

• I have read and agree to the CONTRIBUTING.md bounty terms.
• Preferred payment method can be coordinated privately after maintainer acceptance.

/claim #1395