fix: accept canonical G2 merge push shape

[BunsDev]

Narrows the post-squash verifier to stable, authoritative push fields after the live main event exposed variation in redundant webhook metadata.

Security remains fail-closed through exact repository/main ref, valid before/after SHAs, pushed commit sole-parent verification, unique merged same-repo PR association, squash-to-reviewed-tree equality, and the evidence-only tested-source comparison.

Evidence is candidate until exact-source CI passes.

[Copilot]

Pull request overview

This PR adjusts the G2 evidence verifier to accept the canonical GitHub “push to main after squash-merge” event shape by relying only on stable push payload fields, and updates the evidence document/template to reflect “candidate” status until CI attestation is recorded.

Changes:

• Relaxed main push event validation in the post-squash verifier to avoid relying on redundant/variable webhook metadata (created/deleted/forced/size/distinct_size/commits/head_commit).
• Updated the test fixture push payload to match the newly accepted canonical event shape.
• Converted docs/G2-EVIDENCE.md back to “candidate” placeholders and “not run remotely” matrix rows.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
scripts/check-g2-evidence.py	Narrows push-event provenance checks to ref + before/after SHAs while keeping downstream PR/commit/tree verification intact.
scripts/check-g2-evidence-test.py	Updates the squash-merge push event fixture to omit redundant webhook fields no longer required by the verifier.
docs/G2-EVIDENCE.md	Resets the evidence document to “candidate” placeholders and “not run remotely” results pending CI attestation.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.