feat(evidence): render action reports

[ElbertePlinio]

Summary

• add deterministic, backward-compatible Markdown action timelines
• add escaped static report.html filmstrips with restrictive CSP and confined screenshots
• expose confined MCP actions/report resources with descriptor-bound no-follow reads
• preserve legacy-run behavior and reject corrupt, missing, symlinked, or swapped evidence files

PR 3 of 6 for evidence recording. Action producers and MCP/DevTools instrumentation remain deferred to later slices.

Validation

• bun run typecheck
• bun run build
• focused evidence/CLI/MCP tests: 176 passed
• full suite: 74 files, 916 passed, 2 skipped
• coverage suite: 74 files, 916 passed, 2 skipped; thresholds passed
• serious local review: security + correctness, followed by targeted fix verification; current HEAD clean

Not tested

• platform smoke checks outside Linux

Refs #20

🤖 Generated with Claude Code