feat(case-review): add evidence graph handoff audit

[shashwatgokhe]

Summary

This PR adds a new case-review skill for read-only Evidence Graph Review before a report or specialist handoff.

• Audits scope.md, timeline.md, workitems.md, Evidence records, and structured report Findings and Paths.
• Detects missing or unknown Evidence references, invalid statuses, incomplete Findings, invalid Path types, unlinked Evidence, and low-confidence validated Findings.
• Adds optional SHA-256 fixity checks for case-local artifacts.
• Extends append-evidence.ps1 with -ArtifactPath so Evidence records can store a relative artifact path and hash.
• Wires the skill into the English and Chinese routing matrices, PRIMARY router, smoke checks, coherence checks, tool index, README files, ops documentation, changelog, and architecture diagram.
• Includes six Python unit tests covering valid reviews, unknown references, hash mismatches, strict failures, Markdown output, and documented offline observations.

Why

The repository already defines an Evidence to Finding to Path contract, but there was no deterministic gate to check whether a case package actually satisfied it. This contribution turns that contract into a portable, dependency-free review step without adding network access or target-side actions.

Usage

python3 skills/case-review/scripts/review_case.py work/<case> --verify-hashes --strict

The command emits Markdown by default and supports --format json for CI or other review tooling.

Validation

• PYTHONDONTWRITEBYTECODE=1 python3 -m unittest discover -s skills/case-review/tests
• python3 -m py_compile skills/case-review/scripts/review_case.py skills/case-review/tests/test_review_case.py
• git diff --check
• Python source hygiene check confirms no comments or em dashes in the new Python files.
• PowerShell integration coverage was added to test-p0-friction.ps1.

PowerShell execution was not available in this macOS environment, so the PowerShell parser and Windows smoke suite could not run locally. The Python test suite and static integration checks pass.

Research basis

The fixity and documentation model was checked against NIST SP 800-86, SWGDE Best Practices for Computer Forensic Acquisitions, and SWGDE Best Practices for Archiving Digital and Multimedia Evidence.