ci-ready attestation provenance

Trap: snapshotting the accepted event after initial validation looks equivalent because validation checks the live label, but a rename or re-approval can occur in that gap and become the event CI binds. Fix: snapshot the current accepted actor/event before validation, fail closed and clean up labels if the event read fails, and pass that exact binding through both validations and CI-ready attestation recording. Immediately before adding ci-ready, verify the same title and event again. A renamed or re-approved issue must never reach ci-ready; the proof and live label actor must also match.