feat(core): add evidence journal foundation

[ElbertePlinio]

Summary

• add optional evidence manifest fields and evidence.enabled config
• add a session-scoped active-run pointer and append-only bounded actions.jsonl journal
• add recoverable cross-process append locking, torn-tail repair, 100 MiB truncation, and 20-finalized-run retention primitives
• keep the foundation dormant: no MCP or DevTools producers are wired in this slice

This completes PR 2 of the six-slice plan. Rendering/resources and producer instrumentation remain separate follow-up PRs after both foundations are merged.

Refs #20

Validation

• bun run test packages/core — 239 passed
• bun run typecheck
• bun run build
• bun run test — 895 passed / 2 skipped
• bun run test:coverage — 895 passed / 2 skipped, thresholds met
• multi-model serious review plus targeted fix verification — clean

Known risk

• The existing browser Xvfb cleanup flake tracked in Stabilize browser Xvfb lifecycle tests under full-suite load #32 failed once under full parallel load, then passed in isolation and on the full-suite rerun.
• No platform smoke outside Linux; no runtime producers consume this storage yet.

[ElbertePlinio]

CI is blocked by the existing Xvfb startup/cleanup flake tracked in #32, not by the evidence-core changes.

Evidence:

• attempt 1: bun run test failed in packages/browser/test/session.test.ts (Fake Xvfb did not publish a valid startup marker)
• attempts 2 and 3: bun run test passed, then bun run test:coverage failed in the same test with the same Xvfb ownership-handoff race
• local isolated browser test passed 25/25
• local full test and coverage reruns both passed 895 / 2 skipped
• evidence-focused/core tests remain green

Per the merge gate, #35 remains open and unmerged until the required check is green. No evidence-core code change is indicated by these failures.

[ElbertePlinio]

#32 is fixed and merged in #36. This branch is now rebased onto 572be7d; the evidence patch is unchanged except the release note no longer lists the resolved Xvfb flake.

Post-rebase validation:

• evidence/config/run focused tests: 98 passed
• browser session suite: 25 passed
• bun run typecheck

Waiting for required CI on current HEAD 1c575e2.