fix: harden review receipt evidence

[MageByte-Zero]

Fixes #45.

What changed

• Anchors review evidence paths to the change directory and requires a physical, non-symlink review overlay.
• Verifies review ranges are real Git commits with an ancestor relationship, then stores their canonical commit IDs.
• Revalidates persisted review receipts before dependent waves or closing can rely on them.
• Migrates fixtures to real Git evidence and documents the stricter receipt contract.

Root cause

Receipt metadata accepted caller-controlled paths and SHA-like strings without proving that the evidence or commit range was trustworthy.

Validation

• npm run build
• npm test
• npm run validate -- docs/examples/add-dark-mode
• npm run validate -- docs/examples/refactor-auth-boundary
• node scripts/lint/lint-skills.mjs --include token
• node scripts/spec-superflow.mjs doctor

No release, tag, or npm publish is included.