Governance artifact retention

Trap: /tmp review files, expiring Actions artifacts, or post-freeze evidence look adequate because they initially carry IDs and hashes. Fix: commit the minimum frozen bundle, artifact, and manifest under cases/review; admit later evidence only through an additive, versioned, hash-checked supplement that leaves frozen bytes unchanged and records weaker historical proof for mutable GitHub issue bodies. Include only missing evidence that can change adjudication.