Add SSI validation catalogue controls

[Raafet57]

Summary

• Add the SSI validation catalogue and contract coverage for export-blocking instruction controls.
• Tighten source lineage validation so missing or inconsistent source/link/file/record evidence fails instead of passing by existence only.
• Add single-instruction group conflict checks for duplicate preferred, active overlap, and export eligibility paths.
• Keep the root Payment Intelligence suite boundary clean: /ssi remains an unlinked static pointer to the standalone SSI Control Tower app.
• Update the repo handoff so the branch state, commit status, and closed deployment/publication gates are accurate.

Verification

Local verification completed before push:

• Python SSI suite: 125 passed
• Vitest root suite: 30 files passed, 230 tests passed
• pnpm typecheck: passed
• pnpm lint: passed
• pnpm audit:privacy: privacy-audit: clean (src/)
• pnpm format:check: passed
• pnpm data:iban:check: passed
• pnpm data:bic:check: passed
• pnpm data:cbpr:check: passed
• pnpm build: passed
• git diff --check: passed
• Static credential/privacy scan: clean
• Final cold review: approved, no commit blockers

Docs-only handoff follow-up verification:

• git diff --check: passed
• stale handoff phrase scan: clean
• pnpm format:check: passed

Boundaries

• No deploy, release, tag, or public announcement is included in this PR.
• No production data operation is included.
• SSI Control Tower remains a standalone adjacent app, not a Payment Intelligence module workflow.
• Public SSI evidence remains category-only and synthetic/masked in repo fixtures.