Adjudicate Work enforcement regimes

[sftimeless]

Summary

• vendor keel-permit v1.13.0 claim contracts and Work enforcement schemas
• adjudicate keel.permit_exact/v3, issuance-time Work regimes, and signed pre-effect dispatch regimes
• preserve historical v1/v2 behavior with explicit insufficient_evidence when the regime was not recorded
• compose digest-pinned universal recipe extensions so v4 retains v2/v3 consequence requirements
• reject unsupported future exact-pack profiles instead of silently omitting exact adjudication
• surface issuance-regime evidence for Work roots and children independently
• update the public claim registry and capability inventory through verifier-claims.v5

Safety properties

• current project configuration is never inferred from historical evidence
• runtime proof v1 remains supported but cannot establish a recorded regime
• v2 runtime proof must be schema-valid, signature-valid, pre-effect, and identity-bound
• exact claims render the evidence pack's pinned recipe rather than a verifier-global semantic
• legacy Work packs remain valid; once any issuance regime is recorded, the Work-chain regime claim becomes required and partial recording fails closed

Validation

• ruff check .
• python scripts/check_historical_compatibility_corpus.py --run
• pytest -q -p no:cacheprovider — 690 passed, 38 skipped, 5 xfailed
• release and installed-wheel gates — 28 passed
• keel-permit v1.13.0 artifacts re-synced byte-for-byte