feat(bundle): onchain.kind = "semantos-cell" — one anchor, two checks - #7

Phase 4's Trinote half. The semantos side has had anchor-evidence.ts for a while; this
is the end that consumes it.

Why a fourth bundle kind

Both systems can write to chain. Left alone an integrated request gets anchored twice —
semantos publishes a verified result cell, Trinote publishes a Third Entry — so the same
computation carries two marks, at two costs, with two ways to disagree.

So semantos publishes, and a Trinote bundle records evidence pointing at what it published.

Neither substitutes for the other. An included transaction that commits somebody else's
computation is not evidence about this one; a perfectly bound cell that was never mined is
not evidence at all.

What this side refuses to imply

The on-chain path could have returned ok: true and looked complete. It doesn't. It checks
what it can honestly check — the transaction exists and really has an output at the stated
index, which is what fails when a txid is invented — and then records
semantosCell.inclusionCheckedBy: "semantos (BEEF/SPV); Trinote verifies content binding only". An auditor who reads this result should not come away thinking inclusion was proven
here.

modelBindingHash gets the same treatment: shape-checked and committed, never recomputed,
because this side has nothing to derive it from. evidence_binds_receipt takes it as an
optional argument that means "not checked here" — never "checked and passed".

Broadcast is not inclusion

inclusionProofRef is null for submitted, a reference for confirmed. Holding a txid says a
broadcast happened, which is a different claim from the transaction being in a block. An
empty string is refused — null already means "no proof", and two spellings of one claim
are two digests.

The vectors are the real content

evidence_commit here must equal evidenceCommit() in the semantos cartridge, or both
sides commit to different things while believing they agree. So
tests/vectors/semantos-cell.vectors.json was generated by running that TypeScript:

• 7 accepted objects with their digests and their exact canonical bytes — matching
  bytes is the check that says the encoders agree; a matching digest alone could be a
  collision
• 12 refusals with their reason codes, because a reason code is part of the contract,
  not a log message: a caller that branches on it must behave the same whichever
  implementation it reached

19/19 agree.

It earned itself on the first run — it found the semantos side accepting vout: -1 in
evidenceCommit() while anchorEvidence() refused it. Fixed upstream (3cec4d8d on
fix/verifier-signature-into-main) rather than matched here, along with bounding
inclusionProofRef. Nothing has been anchored under this kind yet, so tightening costs
nothing now and would be a break later.

Verified

492 passed, 107 skipped — 36 of them new. The 2 failures in
test_bonsai35_optimization_matrix.py reproduce unchanged on main in the same
environment. TypeScript side: 244 pass, 0 fail in an isolated clone at 3cec4d8d.