Bind enterprise pilot evidence to its actual checkout

[aruintelligence]

Problem

The enterprise 30-minute pilot report took source_revision from GITHUB_SHA (or null locally), and its verifier never compared that claim with the checkout. A caller could supply a different SHA or edit the report and recompute its unkeyed digest while still passing replay verification.

Change

• Read the actual checkout HEAD and record whether tracked files differ from it.
• Require the report's revision and tracked worktree status to match the verifier checkout before replaying fixtures.
• Document exact-checkout verification and the limits of a dirty worktree and unsigned report digest.

Verification

Two new regressions failed on the prior implementation: a spoofed GITHUB_SHA became the report revision, and a forged revision with a recomputed report digest passed verification. Both now pass. A clean committed checkout generated and verified a report with the correct SHA and tracked_worktree_modified: false. The full Node test suite, public contract and deployment checks, and local links passed.

This is a project-authored checkout binding, not a signature or independent attestation.