Implement V2 secure intake, signed evidence, and lifecycle operations

[DevFoundry-labs]

What changed

• adds the V2 product plan, contracts, discovery kit, decision log, milestones, and issue backlog;
• upgrades SQLite through forward-only schema versions 2–4 with real v0.1 fixture coverage;
• adds HMAC-SHA256 authenticated webhook intake with exact raw-body verification, rotation windows, replay convergence, conflicts, safe rejection audits, and service-actor mapping;
• adds deterministic evidence schema v2, detached Ed25519 manifests, explicit unsigned mode, external trust-anchor verification, public-key export, and historical key-rotation preservation;
• adds retention snapshots, role-gated legal holds, mutation-free digested reports, and non-PII operational metrics;
• adds SQLite online backup, inventory verification, historical public-key preservation, evidence verification, and scratch-only restore drills;
• adds correlation IDs, V2 CLI commands, configuration examples, operator documentation, and the v0.2.0 package version.

Safety and scope

• external provider writes remain disabled by default;
• webhook secrets, raw bodies, private signing keys, password files, and raw bearer tokens are not persisted in evidence or backup artifacts;
• required signing failures roll back completion and open an operational exception;
• evidence verification never implicitly trusts the manifest's bundled public key;
• retention reporting never deletes or moves data;
• restore verification never overwrites the live database;
• Microsoft Entra remains deferred because the conditional pilot-demand gate is not met;
• M0 design-partner discovery in V2-01: Run design-partner discovery and publish the scope decision #8 remains open. This PR does not fabricate interview evidence or claim pilot validation, ROI, compliance, or release readiness.

Local verification

• Ruff formatting and lint pass;
• strict mypy passes for 31 source files;
• 41 tests pass with 90.19% branch-aware coverage;
• dependency audit reports no known vulnerabilities after upgrading the disposable verifier's pip;
• tracked-source secret scan passes;
• v0.2.0 sdist and wheel build successfully;
• the wheel contains migrations 0001–0004 and initializes schema version 4;
• installed-wheel synthetic smoke completes with a valid audit chain, five of five controls complete, duplicate-trigger suppression, legacy evidence, and evidence v2 plus detached manifest.

Tracking

Supports #8, #9, #10, and #11. M0 remains a pilot/release evidence gate even though generic engineering proceeded at the product owner's explicit direction.