Improve model supply-chain evaluation and backdoor regression gates

[KooZuKi]

Summary

• Add evaluation dataset provenance and immutable snapshot/checksum requirements.
• Add release-result binding for model artifact ID, run ID, evaluator identity, timestamp, and environment.
• Add targeted canary/slice/trigger regression gates for applicable model classes.
• Extend the report template with an evaluation integrity matrix and severity guidance.

Validation

• git diff --check
• Local frontmatter check using the repository workflow required fields
• Local prompt-injection scan using the repository workflow patterns

Closes #1171

Bounty

Improver contribution. Preferred payment method can be provided privately after acceptance.