BReg evidence export: represent UUID, reference and vocabulary fields exactly in selectors and facts

[jeremi]

bregctl generate evidence-source (the exporter in crates/registry-breg/src/evidence_source.rs) maps a uuid or reference field to a bounded string of exactly 36 characters, and a vocabulary code to a bounded string, both for selector profiles and for output facts. Evidence's selector contract has no UUID lexical type, and its Version 1 fact schema subset (the string arm of the schema validator in crates/registry-evidence/src/bundle.rs) admits format: date and date-time only and no pattern, so an exact validator is not expressible today.

Consequences:

• Selector side: a same-length value outside the domain passes Evidence's selector validation and reaches BReg, which refuses it with the audited request.invalid problem before any read (validate_field_value runs first). Evidence reports a source failure instead of a selector refusal.
• Fact side: a malformed value of the right length from a drifted source passes the response and fact-schema gates and can reach a signed assertion. The returned-identity check covers the identity field only.
• Vocabulary codes need the codelist artifact and its version, which the export does not carry.

Options, decision pending:

1. Extend the Evidence schema subset with a uuid format in its own registry-evidence change, and have the exporter emit it for uuid and reference fields in both selectors and facts. Recommended: small, closed, and serves both sides.
2. Refuse these field types as not losslessly representable and point at a custom adapter.
3. Keep the bounded string and document the limit in products/evidence/reference/authoring-projects/SOURCE-EXPORT.md and the exporter's output.

Vocabulary fields need the codelist artifact under any option, or a refusal. The tutorial registry uses string selectors and is unaffected.

Origin: review of PR #865 (raised by Codex, answered in-thread).