Improve model promotion evidence gates

[DENGXUELIN]

/claim #1377

Summary

• Adds model promotion and deployment binding gates to model-supply-chain.
• Requires evaluated artifact identity to match approval, deploy manifest, served runtime identity, adapter/base-model binding, and rollback targets.
• Adds benign and vulnerable JSON fixtures for immutable artifact promotion versus mutable main/latest/bucket alias over-crediting.

Validation

• git diff --check origin/main...HEAD
• JSON parse check for both fixtures
• Markdown fence-balance and required-marker checks
• Added-line sensitive-pattern scan
• git merge-tree --write-tree origin/main HEAD matched HEAD^{tree}