fix(research): bind claims to exact source versions

[drewstone]

What changed

• Bind claim evidence and source confirmation to the complete source identity: registry id, original URI, and SHA-256 content hash.
• Snapshot source proposals before asynchronous extraction or adapters can mutate them; store exact submitted bytes under full-hash raw paths.
• Reject unsafe URI-only ledger migration with a typed error while preserving legacy bytes.
• Require materialized contradiction pairs to be backed by exact registered evidence.

Why

In 6.2.0, registering bytes A at a URI also activated claims extracted from different bytes B at the same URI. The ledger joined evidence to confirmation by URI alone.

This changes the public commitSources argument from string URIs to SourceRecord values and changes the durable ledger schema, so the follow-up release must be 7.0.0.

Proof

• 518 tests passed; 12 skipped integration tests
• typecheck passed
• Biome lint passed
• build passed
• publint, packed type checks, and clean-consumer package verification passed
• adversarial tests cover same-URI A/B bytes, concurrent versions, async mutation, partial batches, restart reconciliation, mixed path/text registries, orphan contradictions, exact raw bytes, and byte-preserving legacy refusal