[EPIC] Canonicalize evidence and audit artifact path

[Cubits11]

Purpose

Make CC-Framework produce trustworthy evidence artifacts suitable for audits, papers, and SysESoft positioning.

Problems

• evidence_bundle.py and audit_runner.py overlap.
• Audit JSON should reject non-standard NaN values.
• Bundle metrics need typed structures.
• Plotting should be optional and should not poison core imports.
• Evidence artifacts must be deterministic, hashable, and verifiable.

Target

• evidence_bundle.py becomes the canonical evidence artifact system.
• audit_runner.py becomes a compatibility/demo wrapper or moves to Tier 1b.
• Audit JSON is strict.
• Bundle outputs are deterministic and verifiable.
• Plotting is optional and isolated.

Definition of Done

• Evidence bundle contract documented
• Audit runner role decided
• Audit JSON uses strict serialization
• Tamper-evidence tests pass
• Evidence bundle smoke test passes

Child Issues

• Decide canonical role of evidence_bundle.py vs audit_runner.py
• Add strict JSON audit serialization
• Add audit chain tamper tests
• Add evidence bundle smoke test
• Move optional plotting behind a clean boundary

Notes

This epic is the bridge between CC-Framework as a research repo and CC-Framework as an assurance artifact generator.