docs: define external execution evidence verification

[carloshvp]

Summary

• add TRACE verification guidance for optional external execution evidence
• clarify that untrusted/unconfigured receipts are unverified addenda, not core Trust Record failures
• document the physical-execution and functional-safety boundary in the spec and limitations

Closes #34.

Validation

• PYTHONPATH=src python3 -m pytest

Note: python3 -m ruff check . currently reports an unused json import in tests/test_sign.py on fresh origin/main; this PR does not touch that file.

[imran-siddique]

Closing in favour of #38 — that PR covers the same issue (#34) with the complete implementation (schema update, models.py, tests, and spec section §3.3.1). Merging both would duplicate the change and create conflicts. Thanks for the contribution; the approach in your docs-only change is sound and the substance is captured in #38.