feat(evidence): make connector truncation explicit

[huygdv]

What changed

• defines a backward-compatible source artifact safety contract
• adds validateSourceCapture for connector-derived evidence
• requires connector captures to declare truncated: true|false
• requires truncated captures to retain a full artifact URI, SHA-256, byte length, bounded preview, and retrieval hint
• adds a standalone pack-level validator and dedicated source-artifacts CI workflow
• gates add-match-day.mjs in memory before any pack file is written
• updates the scheduled World Cup agent, live-update workflow, and Pages publication gate

Why

A connector response may be only a preview. Treating a silently truncated payload as complete evidence can publish an incorrect scoreline or causal claim. This PR makes completeness explicit while preserving deterministic ingest and all existing direct URL citations.

Compatibility

• existing source objects with type, citation, and url remain valid
• stricter rules activate only when a source includes capture
• no current pack data is rewritten
• full artifact payloads stay outside events.json; the pack retains only provenance metadata
• the existing structural and causal-quality validators remain unchanged

Validation

• node scripts/source-artifact.test.mjs
• node scripts/validate-source-artifacts.mjs
• dedicated source-artifacts GitHub Actions workflow: passing

The first CI run exposed an unrelated pre-existing causal-quality failure when the existing workflow was retriggered. The implementation was separated into its own gate rather than weakening or bypassing the semantic validator.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9469811ad6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Gate Pages deploy on source capture validation

For pushes to main that change packs/**, this Pages gate still only runs the unit test plus validate-pack; validatePackData does not inspect event.sources, while the new CLI that rejects truncated connector captures is scripts/validate-source-artifacts.mjs. Since the deploy job depends only on this workflow's validate job, an invalid connector capture can still be published to Pages even if the separate source-artifacts workflow fails, so add node scripts/validate-source-artifacts.mjs here or make validate-pack call it before deploy.

Useful? React with 👍 / 👎.