fix(deps): close semantic receipt validation gaps

[ll7]

Summary

Close semantic fail-open paths in the Issue #8163 dependency evidence validator:

• bind archive-audit package, artifact, and notice rows to the checked-in policy;
• bind upstream-tag and immutable notice checks to the policy commit and archive evidence;
• require the full strict-report content digest/schema/freshness contract;
• validate candidate manifests and members through the canonical bundle validators with one
  canonical member order;
• reject nested schema extras, swapped notice mappings, malformed types, symlinks, and lexical
  traversal in operator-local evidence paths.

The new regression tests mutate evidence and recompute the receipt hashes, proving that
hash-valid but semantically forged content remains rejected. The 36 Issue #8163 rows remain
pending and non-authoritative; this change does not assert legal approval or release readiness.

History and scope

This is a successor to #8175. PR #8175 was merged externally at 4daa9ed3b100db09a96aa50525ebedd8587ba1a6 before its independent blocking review; this draft ports only the reviewed validator hardening from that review and the subsequent no-merge findings. The feature branch includes the exact current origin/main tip a39a821721e5aa9de7c3d3771e85e27ee68908f1. It must remain draft pending independent review.

Refs #8163

Validation

• uv run pytest -q tests/tools/test_check_dependency_license_inventory.py — passed, including all semantic mutation/path regressions
• uv run pytest -q tests/tools/test_check_dependency_license_inventory.py tests/dev/test_software_promotion.py tests/dev/test_software_candidate_materialization.py tests/test_schema_validation_dependency_policy.py — passed (82 tests)
• uv run ruff check scripts/tools/check_dependency_license_inventory.py tests/tools/test_check_dependency_license_inventory.py — passed
• uv run ruff format --check scripts/tools/check_dependency_license_inventory.py tests/tools/test_check_dependency_license_inventory.py — passed
• PR_READY_MODE=final BASE_REF=origin/main PR_READY_PR_BODY_FILE=/tmp/pr8182-final-body.md scripts/dev/pr_ready_check.sh — clean-tree run reached 99% of the 5,939-test core lane with no test failures, then was interrupted during coverage/xdist teardown; focused and broader gates above are green. Full readiness remains unconfirmed; base a39a821721e5aa9de7c3d3771e85e27ee68908f1, head 5867ca9c83ad8bfa9c561165e709f3a2b964e9c9

No merge, tag, publication, credential handling, or legal approval is requested by this PR.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: f436d920-b09f-425a-98ac-714461995049

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🔍 PR Contract Check Summary

Overall Status: 🟢 PASSED

Check	Status	Description
1. Closes-discipline	✅ PASSED	Demand Refs #N for epic issues
2. Closure declaration	✅ PASSED	Require Closes/Refs for title issues
3. State-refresh-only	✅ PASSED	Reject docs/context state updates
4. Evidence hygiene	✅ PASSED	Checks markers and provenance fields
5. Evidence writer usage	✅ PASSED	Require the shared marked writer path
6. Successor discipline	✅ PASSED	Require successor statement on multi-PR issues
7. Worker-lane label	⚪ None	Label PRs from cheap worker lane
8. Placeholder docstring ratchet	✅ PASSED	Reject NEW TODO/empty docstrings in added diff lines

ℹ️ Info

• No worker-lane provenance detected.

---

This check is mechanized. Please resolve any blockers to pass CI.