P0: Build runnable PoCI end-to-end evidence demo

[safal207]

Parent: #180
Depends on: #182, #183, #184, #185, #187

Objective

Create a reviewer-friendly vertical demo that produces and verifies a portable Action Proof Envelope without external services.

Demo story

signed intent
  -> agent proposes a high-risk payment or compute purchase
  -> ProofPath evaluates authority and scope
  -> causal parent is attached
  -> mock executor produces a receipt
  -> observer records the result
  -> witness verifies evidence
  -> bundle is exported
  -> offline verifier returns ACCEPT
  -> one artifact is tampered
  -> verifier returns CHALLENGE or BLOCK

Target directory

examples/poci-witness/

Deliverables

• README.md with one-command quickstart;
• deterministic demo generator;
• valid evidence bundle;
• tampered evidence bundle;
• expected console transcript;
• verification report with envelope root and reason codes;
• architecture diagram;
• script suitable for a 90-second screen recording.

Definition of done

• Clean checkout can run the demo with documented prerequisites.
• Valid flow returns exact expected ACCEPT output.
• Tampered flow returns exact expected rejection output.
• The exported bundle verifies without the running gateway.
• Re-running the demo yields identical normalized evidence except explicitly documented runtime fields.
• Demo makes no claim that mock execution proves real-world truth.

[safal207]

Implemented in draft PR #196: one-command reviewer demo, deterministic ACCEPT and CHALLENGE reports, committed expected transcript, architecture diagram, portable JSON output, and a subprocess integration test. The demo deliberately uses committed mock evidence and does not claim real-world execution truth.