Add evidence redaction fixture pack

[Li-AmG]

Delivery

Related bounty: #89 / Frantic bounty #38

Artifacts delivered:

• fixture pack under verify/fixtures/evidence-redaction/
• report at docs/evidence-redaction-fixtures.md

Verification

Commands that prove acceptance criteria:

runx --version
node -e "const fs=require('fs'); const p='verify/fixtures/evidence-redaction/manifest.json'; const manifest=JSON.parse(fs.readFileSync(p,'utf8')); for (const f of manifest.fixtures) { const path='verify/fixtures/evidence-redaction/'+f.file; const text=fs.readFileSync(path,'utf8'); if (f.valid_json) { const j=JSON.parse(text); if (!j.summary || !Array.isArray(j.observations) || j.observations.length===0) throw new Error(path+' missing summary/observations'); } for (const cat of f.redaction_categories) { const c=manifest.categories.find(x=>x.name===cat); if (!text.includes(c.sentinel)) throw new Error(path+' missing sentinel '+cat); } } console.log('PASS redaction fixtures validated:', manifest.fixtures.length);"
rg -n "AKIA[0-9A-Z]{16}|ghp_[A-Za-z0-9_]{20,}|xox[baprs]-|sk-[A-Za-z0-9]{20,}|BEGIN (RSA|OPENSSH|PRIVATE) KEY" verify/fixtures/evidence-redaction docs/evidence-redaction-fixtures.md

Observed runx --version: runx-cli 0.6.8.

The fixture pack includes 3 safe JSON fixtures and 3 unsafe synthetic sentinel fixtures covering token, local path, private URL, and private email redaction.

Receipt

Runx receipt link, if claimed: not claimed in GitHub PR; local validation used runx CLI 0.6.8.

Closes #89