Improve ONNX bundle runtime evidence gates

[DENGXUELIN]

/claim #1385

Summary

• Adds an ONNX bundle and runtime-provider evidence gate to model-supply-chain.
• Requires reviewers to bind the full .onnx/.ort bundle, external tensor files, conversion provenance, parity validation, provider fallback policy, effective provider logs, and custom operator provenance.
• Adds skill-local JSON fixtures for both a vulnerable .onnx-only digest/provider-fallback case and a benign complete bundle/runtime-policy case.

Validation

• git diff --cached --check
• git diff --check origin/main...HEAD
• Parsed both JSON fixtures with ConvertFrom-Json
• Verified Markdown fence balance
• Verified MSC-ONNX-01 through MSC-ONNX-08 markers
• Added-line sensitive-pattern scan
• git merge-tree --write-tree origin/main HEAD matched HEAD^{tree}