fix: harden cold-start continuity receipts

[uncfreak1255-code]

Summary

• normalize a leading full Git SHA while still rejecting wrong or embedded commits
• accept repo-relative or absolute evidence paths that point to the required files
• recognize equivalent protected-main wording and report Codex timeouts truthfully

Proof

• npm test
• npm run smoke:cold-start
• Codex autoreview: clean

Follow-up to #8 after its post-merge smoke exposed presentation-sensitive checks.