[P0][CI] Enforce artifact-backed VERIFIED claims

[flyingrobots]

Owner: CI Engineer\nEstimate: 4h\nAC:\n- VERIFIED requires workflow/job, run ID, commit SHA, artifact name\n- enforce claim states VERIFIED/INFERRED/UNVERIFIED\n- fail CI on violations

[flyingrobots]

All ACs met: validate-evidence job in det-gates.yml runs generate_evidence.cjs + validate_claims.cjs, enforces artifact presence per classification tier, and cross-checks claim IDs against CLAIM_MAP. CI fails on missing or invalid evidence.