fix: ingest validation evidence into cloud readiness

[Jammy2211]

The cloud board reported missing smoke, installation and release evidence even after those checks passed. Its daily workflow now reads smoke results and reconstructs release evidence from the newest integration run plus its matching TestPyPI rehearsal.

The collector verifies version, producer run ID, attempt, SHA and chronology before folding artifacts through the existing validator. It retains producer timestamps, never substitutes an older integration pass, and keeps missing evidence incomplete and failed producers adverse. The artifact search is bounded to 20 rehearsal runs and runs only in the daily cloud job; the local tick and all readiness thresholds remain unchanged.

Closes #263.

API Changes

No scientific-library API changes. Adds the read-only heart.checks.cloud_validation module and the release_evidence.rehearsal_repo configuration entry. No build, release or publication is dispatched by the collector.

Validation

• Full Heart suite: 1,139 passed in 55.38s; two additional edge cases added afterward, with all 40 focused collector/wiring tests passing.
• Tenant firewall and git diff --check passed.
• Real read-only artifact collection matched rehearsal 36895121274 with integration 36899858987 and smoke 36909756099 in a separate state directory. Canonical readiness computed GREEN/100 using those artifacts and current CI SHA observations, retaining the original 2026-10-01T16:51:35Z evidence timestamp.
• Regression coverage includes missing/mismatched/expired artifacts, producer failure/cancellation, pending runs, missing attempts, bounded search, chronology, repeated-ingest age, moved/missing library SHAs and non-release profile.
• Initial full-suite path test exposed missing Brain sibling setup in the isolated bundle; adding the standard sibling link made that unchanged test pass. No test was waived or weakened.

Limitations

Matching rehearsal artifacts must remain accessible within the last 20 main runs. Missing artifacts or cross-repo token access leave honest incomplete evidence; deployment verification remains a post-merge action.