feat(compliance): change-management evidence export (CC8.1)

[TinDang97]

feat(compliance): change-management evidence export (CC8.1)

First build task of R8 soc2-groundwork (contract frozen sha256:6dad0c27, ADD gate PASS).

A repo-governance tool that produces auditable SOC 2 CC8.1 evidence: for every landing on main in a window — the required checks that gated the PR, the approver(s), and the resulting main commit — with any control exception flagged, never omitted, and a disclosed self-approval recorded as not independent (never laundered into review).

Design

• Pure core build_evidence(source, …) over a ChangeSource port — no IO, no clock-now, no network; identical source output ⇒ identical evidence (M2).
• IO adapter GitHubChangeSource is the only thing that touches GitHub — design-for-failure: per-call timeout, bounded-backoff retry, full pagination, and a truncated/rate-limited fetch raises IncompleteFetch so a partial window can never be emitted as complete (M6).
• Squash-honest (M1): this repo squash-merges, so main is a new sha with no checks of its own. Evidence credits the PR's required-check conclusions and records both the tested-head sha and the resulting main sha — never invents a run on the squashed sha (R:UNTESTED_MERGE).
• Lives in scripts/soc2/ (repo tooling, not the gateway wheel; imports nothing from gateway.*).

Tests — 9 red-first, in the gateway suite via a zero-network fake

clean merge · missing-context flagged · self-approval not independent · direct-push flagged · IncompleteFetch propagates · half-open window · pure+deterministic · squash records both shas · payload/secret-free summary. Every Must/Reject/Edge/probed-A bound.

ruff check+format clean; no gateway runtime touched (isolated new files) so the full suite is a pure regression floor.

⚠ Four-eyes

The GitHubChangeSource.merges() live walk is left as a documented NotImplementedError (the pure evidence semantics are what this task freezes + tests); wiring it to the live API is an operator step. And per this milestone's own theme: merging this via byte-approval adds to the tally independent-review-control exists to retire — recorded honestly.

[pilotspacex-byte]

Operator-directed approval via pilotspacex-byte to satisfy the required-review gate on a solo-maintainer repo. DISCLOSED and NOT independent four-eyes: same operator who authored the change, second GitHub account. Evidences a green required check on the merged artifact, not a genuine second reviewer. Fittingly self-referential: this PR ships the very tool (change-management-evidence-export) that FLAGS a self-approval as non-independent. Added to the auditor sample set (#117/#118/#199-#208); still owes a real second human before the SOC 2 audit — R8 independent-review-control is the fix.