feat: verify published HK snapshot evidence

[Pigbibi]

Summary

• add scheduled, read-only validation of the published HK snapshot, manifest identity, SHA-256, and monthly freshness budget
• retain parked status and create/update a single evidence issue on failure; the job cannot generate, publish, deploy, or trade
• make monthly AI-audit reruns idempotent and retry only transient dispatch failures
• document the operational boundary and local health command

Verification

• PYTHONPATH=src pytest -q (passed)
• targeted artifact-health and workflow security tests (passed)
• real read-only GCS verification passed against the current HK snapshot and manifest