test: certify project-registry evidence contracts at exact head

[ORESoftware]

Supplemental cross-organization certification carrier for ORESoftware/project-registry#78.

Source head pinned: 11559ec51706bd80d76e38c7ee942644bf9f8669.

The carrier mirrors only the Task 1/2/12 evidence bundle and verifies each copied file against the source PR's Git blob ID before running behavior tests. It checks:

• incomplete owner/repository acquisition remains explicit (partial, inaccessible, not-installed, uninspected);
• zero-step jobs cannot be PASS;
• source SHA drift invalidates certification;
• the CI receipt schema exposes PASS/FAIL/NOT_RUN/BLOCKED states;
• the formal-evidence schema requires implementation-linked tests and a detected negative control.

The workflow emits evidence/project-registry-pr-78-certification.json and uploads it as an artifact. This is deliberately supplemental evidence and does not override source-repository required checks.

Context: context:zed-pkg-test; GitHub owner id 309134292; Linear project github.com/zed-pkg-test (2a3e49af-e2a2-4a1a-9385-f7e9a217a14f), team eb8ab169-5afe-4b6f-9cab-3f2aa3e887dc.