Worktree Controller 1.32.8

• Place shared bounded, FD-bound evidence document reads in cleanup_evidence, updating
  preservation, recovery and migration consumers. Retain raw-byte hashes, file and ancestor
  identity checks, size limits and refusal codes; remove four private cross-module imports.
• Separate ordinary installed upgrade acceptance from the two historical restoration cases,
  requiring declared staging provenance and matching CLI/capability prerequisites before running.
• Preserve staged source bindings in disposable fixtures and cover wrong-source and identity-drift
  refusal. Keep every selected case mandatory; record unrequested cohorts without counting passes.
• Test/document decision-aware consumers. Keep CLI contract 61, capability versions and
  storage layout 5 unchanged.
• Scope the installed exit/rescan fixture's process enumeration to its real child so unrelated
  protected host processes cannot decide the result. Retain real procfs and refusal checks.

Source commit: 03ef54cd965aaba3d06a842663209713d7bdb668.