🐛 fix(evidence): canonicalize migrated state fields

[zrr1999]

Summary

• canonicalize legacy Evidence field names while migrating refs in subject/goal review records, canonical ask receipts, and role-run activity events
• canonicalize artifactRefs to evidenceRefs in workflow completion digests and schema-v2 task-run completion summaries, while preserving schema-v1 task fields for their existing in-memory upgrade path
• fail closed when legacy and canonical Evidence field names coexist
• discover canonical review Evidence refs on replay so the post-migration plan is a zero-change no-op

Context

A live namespace migration correctly rewrote legacy artifact: values to evidence:, but left some values under artifactRef / artifactRefs. The next dry-run then rejected the migrated state with evidence_in_artifact_field. The first two affected live workspaces were restored from official migration backups before this fix.

A later startup probe also proved that workflow completion digests must be canonicalized by the migration rather than adding a permanent runtime compatibility alias. The migration now performs that hard cut and keeps legacy names confined to migration code/tests.

Validation

• pnpm --filter @zendev-lab/spark-artifacts test (36/36)
• pnpm run check:static
• pnpm run test:unit
• isolated-copy simulation across all 4 reachable registered workspaces: Artifact hashes stable, replay blockers 0, replay changed files 0, replay backups 0
• formal live apply + schema-field follow-up: 2,610 legacy Evidence records migrated; 27 Product Artifacts byte-stable; final all-registry dry-run has 0 blockers, 0 changed files, and no replay backup
• daemon rebuilt from this branch and restored to running/serving against the migrated state