EPIC-0460: require committed task evidence for apply criteria

[epowell40]

Summary

• publish a reviewed replace-text-note schema with only actual mutation inputs required
• reject rolled-back preview evidence for apply criteria while preserving explicit desired-state no-op reads
• align typed MCP bounds and regenerate certification/exposure trust anchors

Validation

• backend: 2892 passed, 3 skipped, 0 failed
• MCP: 220 passed
• native: 837 passed on net48 and 837 passed on net8
• certification/exposure generation and architecture boundaries passed