feat(release): bind hosted correction evidence

[nstranquist]

Summary

• add a fail-closed post-first-push correction verifier and strict JSON schema
• bind a clean verifier commit, tree, command digest, and schema digest
• verify the complete no-bypass main ruleset and provider-bound checks
• record only redacted facts from the immutable private v2 receipt

Commit structure

1. feat(release): add hosted correction verifier
2. docs(release): define correction receipt procedure
3. docs(release): record correction receipt evidence

Verification

• go test -count=1 ./...
• go test -race -count=3 ./...
• go vet ./...
• actionlint
• golangci-lint run ./...
• gitleaks history and worktree scans
• git fsck --strict --no-dangling
• Draft 2020-12 validation of the private receipt
• advisory Simple English review of the runbook, KEP, and evidence

This PR is stacked on #5. It does not include the private receipt and does not authorize a tag, release, or pull-request merge.