fix(dynamic-evaluation): canonicalize evidence-reference membership

[seonghobae]

Defect

Fresh exact-head review of existing dynamic-evaluation writer #1727 found an identity inconsistency. criterion_refs and run items were canonical mathematical membership, but provenance_refs and validation_evidence_refs passed through _reference_tuple(...) in caller order. The contract gives those fields evidence-membership semantics, not administration chronology; temporal/event order belongs to TEPP. Semantically identical item evidence could therefore receive different immutable snapshot_sha256 values solely because the same evidence references were supplied in a different container order.

This is contract identity/provenance admission only. It must not change scoring, calibration, DIF/fit, linking arithmetic, reference-status rules, or foreign-owner boundaries.

Implemented on the existing single-writer lane

• source-level RED 1f88c46eb19fc3de28c8dbb8555af2d295d31fad adds provenance-reference and validation-evidence order-invariance regressions;
• GREEN 393dcacbd28aca56472606929f5c6adb5890775a changes _reference_tuple(...) only after exact carrier/cardinality/reference/duplicate validation to return canonical lexical membership;
• governed changelog/current head 6179ca2d7d0a9d24719f9bd70fc8b60698e2b745 records that these collections are evidence membership while temporal/administration sequence remains TEPP-owned;
• duplicate-reference rejection, maximum cardinalities, exact opaque reference text, criterion/item-set canonicalization, fail-closed state rules, and all psychometric arithmetic remain unchanged.

Current owner PR is Draft #1727 at exact 6179ca2d7d0a9d24719f9bd70fc8b60698e2b745 on protected main@b5a3a0c1057d4b53d7a4bb18e0de69f630c2b45c.

Landing condition

Keep this issue open until #1727 lands normally. Current exact-head required evidence is non-passing at the Actions control plane: CodeQL PR 33710431487 is terminal startup_failure with jobs=[], CI 33710430288 is pending with jobs=[], and scanner/security lanes remain queued or pending. The exact canary is on ContextualWisdomLab/.github#712. No bypass, predecessor-success transfer, no-op retrigger, self-approval, or gate weakening is authorized.

[seonghobae]

Implemented on the required existing writer lane. Source-level RED 1f88c46eb19fc3de28c8dbb8555af2d295d31fad adds tests/test_measurement_dynamic_evaluation_evidence_ref_order.py and proves that identical provenance/validation-evidence memberships in reversed caller order otherwise produce different item identities. GREEN 393dcacbd28aca56472606929f5c6adb5890775a changes only _reference_tuple(...): after exact built-in carrier, cardinality, opaque-reference, and duplicate validation, it returns lexical canonical membership. Governed changelog evidence 6179ca2d7d0a9d24719f9bd70fc8b60698e2b745 records that these refs are membership while temporal/administration order remains TEPP-owned. Keep #1735 open until Draft #1727 lands normally. Current exact-head hosted gates are non-passing at the Actions control plane (CodeQL PR startup failure, CI jobs absent, security/scanners queued), so source-level GREEN is not merge evidence.