test: add evidence predicate conformance vectors

[tomjwxf]

Summary

Adds a dependency-free conformance suite for the proposed signed evidence predicate.

The suite proves four reliance outcomes:

1. an independently pinned custodian source is accepted;
2. an absent as_of is omitted from the signed claim;
3. a copied trusted kid with a forged signature is rejected; and
4. receipt-signer self-corroboration is rejected even when the source signature is valid.

It also rejects the structural anti-pattern as_of: null and adds the suite to the repository's GitHub Actions workflow.

Trust Model

A source signature is not independently corroborating merely because it verifies. The verifier requires an out-of-band trust policy, a source public key distinct from the receipt signing key, and a source control domain distinct from the receipt signer.

Verification

./evidence-predicate/run.sh

Result: all four signed vectors and the nullable-as_of negative fixture pass.

Existing Repository Limitation

The pre-existing general ./conformance/run.sh still reports its independent gaps: three implementation drivers are stubs and the local protect-mcp driver emits zero receipts. This PR does not mask or change those outcomes.