Add provider-neutral TA/KYC evidence

[0xMuang]

Stacked dependency

Depends on #84 (feature/rfq-durable-coordinator) and #85 (feature/rfq-service-hardening). This PR is intentionally based on feature/rfq-service-hardening, not main.

Scope

• Adds provider-neutral TA/KYC evidence normalization to services/compliance-data.
• Produces PII-free evidence hashes and canonical payload hashes without committing raw provider payloads or investor PII.
• Fails closed on provider outage, stale evidence, rejected decisions, mismatched subject/asset, unsupported provider, invalid freshness, or malformed inputs.
• Documents provider-neutral onboarding/testing expectations and updates FEATURES, PROGRESS, QUALITY, and compliance-data README.

Tests / validation

• npm test --prefix services/compliance-data — passes.
• forge test --offline --match-contract AcquisitionSourceTest — 8 passed.
• forge test --offline --match-contract BUIDLLikeFlowTest — 7 passed.
• forge test --offline --match-test claim — 8 passed.
• forge test --offline --match-test identity — 4 passed.
• forge test --offline --match-contract ElementsTest — 19 passed.
• forge test --offline --match-test hostile — no Foundry tests found; hostile provider cases are covered by the compliance-data smoke tests.
• git diff --cached --check — clean before commit.
• Staged secret/scratch scan completed; existing untracked contracts.md, deployments/, and desc.md were preserved and not staged.

Known blocker / not tested

• scripts/check.sh remains blocked by pre-existing forge fmt drift in script/DeployProductionCore.s.sol and script/DemoScenarios.s.sol.
• Full E2E was skipped in this integration step to preserve existing untracked deployments/ artifacts.

Production boundaries

• ERC-3643 / ONCHAINID remain issuer-controlled external trust boundaries.
• This PR does not assume or endorse a vendor API contract.
• Production deployment must provide an authenticated provider adapter, transactional HA evidence store, WORM/SIEM audit path, and issuer-approved claim writer before live claim issuance.

No merge into main is requested here.