feat: record Flutter evidence reports

[ElbertePlinio]

What changed

• add the Rust-only, single-shot pickforge evidence record command
• validate the owned Flutter receipt and bounded JSON envelope before writing
• copy reviewed PNG/JPEG/WebP evidence into private project run storage with content hashes and atomic publication
• emit canonical evidence.json plus escaped report.md, with structural text-secret redaction
• update the Flutter workflow pack to v2 with the exact evidence-recording contract

This is PR 4 of issue #64's six-PR stack. It is based on PR #69 (feat/64-flutter-pack); PR 6 will handle alpha integration and release gating.

Validation

• cargo fmt --all -- --check
• cargo clippy --workspace --all-targets --locked -- -D warnings
• cargo test --workspace --locked — 80 passed
• Windows MSVC cross-target cargo check and Clippy
• OSV Scanner v2.3.8 — no unfiltered advisories
• byte-exact JSON/Markdown golden, collision, redaction, hardlink/symlink, receipt compatibility, and clean-project tests
• serious-backend local review plus independent final Fable verification — clean at reviewed HEAD d6c908a

Not tested / limits

• Windows-native runtime behavior is left to CI; macOS was not tested locally.
• Text is redacted; screenshot pixels are not. The workflow requires human pixel review before recording.
• No journal, retention policy, generic session system, project writes, tool execution, or network behavior is added.

Risk class: serious backend / persistence and trust boundary.

Refs #64

[ElbertePlinio]

Ready for human review

Reviewed HEAD: f31101aeb08baaf2a4d5ca6e2079f6205f8bfb11
Base: feat/64-flutter-pack

All required CI is green in run 32087828087:

• dependency audit
• Gitleaks history scan
• Ubuntu Rust fmt, Clippy, and tests
• Windows-native Rust fmt, Clippy, and tests
• headed Bun tests, coverage, and build

The final Windows fix also prevents CLI subprocess tests from resolving and mutating the real Windows user profile. Independent changed-HEAD review finished CLEAN.

Status: Ready for human review. No merge or release performed.