feat: add proof-carrying evolution

[EvanProgramming]

Summary

• require non-regressing paired shadow replay before learned-artifact promotion
• expose evidence cards, applicability envelopes, revalidation state, and task-family metrics
• downgrade environment-mismatched guidance and turn corrections into regression cases

Security

• replay endpoint records paired sandbox results and never executes commands
• learned artifacts still cannot grant permissions, create dynamic tools, contain secrets, or modify external skills

Validation

• make check
• KYROZEN_DB_PATH=/state.sqlite3 make test (35 tests)
• API learning smoke
• benchmark unittest replay
• git diff --check