[FR-008] Maintainer can reproduce single eval from manifest (make reproduce)

[explosivebit]

Trace: PRD prd-v0-1-smoke-evaluation-run · FR-008 · ADR-002 (evaluator-only reproduce) · SC-2 · SC-6

Capability: make reproduce HASH=<run_hash> EVAL_ID=<eval_id> loads cached raw_output from artifact_refs, re-runs evaluator (NO LLM call), diffs evaluator_json on deterministic fields.

Acceptance:

• AC-2 from RFC: 0 diff on deterministic fields (excluding timestamps, token UUIDs)
• AC-3 from SPEC: every eval_id has raw_output whose sha256 matches artifact_refs
• Invariant [FR-002] Maintainer can validate stack spec (raw-llm) against contract #2: NEVER calls LLM API during reproduce

Implementation locus: apps/eval-core-py/src/orchestrator/reproduce.py + infra/scripts/reproduce-local-run.sh