feat: enforce sensing evidence claim gate

[ruvnet]

Summary

Adds the ADR-328 sensing evidence and claim gate as a strict Rust library and CLI.

The gate:

• binds every evaluation to a protected claim class
• distinguishes synthetic, simulator, mock, recorded-hardware, and live-hardware sources
• requires canonical leak-free held-out environment IDs
• requires aggregate and per-room samples, including per-room positive and negative minima
• requires aggregate and per-room confidence-bound metrics from the exact policy metric set
• binds the exact manifest, source commit, model, split, report, evaluator, reviewer, reproducer argv, artifact digests, statement, and public surface paths
• rejects placeholder or reused artifact digests, unregistered metrics, unsigned witness fields, exaggerated unregistered statements, and class downgrades
• emits a deterministic machine-readable receipt containing exact manifest and policy SHA-256 values plus ordered rule results

The committed policy deliberately enables research only. Production and safety are disabled until RuView has a real presence evaluator, artifact retrieval and hashing, and authenticated independent attestations. Even an enabling test policy can produce only metadata_attested; production is never claim_releasable.

CI now pins the policy digest, rejects an empty or improperly nested claim inventory, gates every manifest, retains receipts, associates changed benchmark/release/model-card surfaces with exact manifests, and places the enforcement path and claim surfaces behind CODEOWNERS. This workflow is repository evidence lint; it does not gate the external Hugging Face upload.

Validation

• cargo test -p wifi-densepose-train --no-default-features sensing_claim_gate -- --nocapture: 25 passed, 0 failed
• cargo test -p wifi-densepose-train --no-default-features model_gates -- --nocapture: 13 passed, 0 failed
• final CLI research inventory: exit 0, research_only, metadata_gate_passed: true
• final CLI protected production mismatch: exit 2, denied, claim_releasable: false
• Rust formatting check for the two new source files
• workflow YAML parse and all eight shell blocks checked with bash -n
• all evidence JSON parsed, pinned policy digest matched, and git diff --check passed
• exact remote tree SHA matches the reviewed local commit tree

After the full focused run, the final top-level benchmark surface allowlist extension passed its targeted unit test. The local runner then hit an unrelated permission error launching a filtered integration-test executable; CI should rerun the complete workflow.

Residual risk and honest scope

• Metadata and hex digests are not proof. There is no artifact retrieval, capture authentication, evaluator signature, or independent trust root yet, so production and safety remain disabled.
• Existing README and documentation claims are not retroactively attested. This is a forward-only control and the legacy claim audit remains open work.
• README claim detection is a conservative keyword lint, not semantic proof. CODEOWNERS covers the known README, benchmark, release, and model-card surfaces, but branch protection must require Code Owner approval for that control to bind.
• The repository does not automate the external Hugging Face publish path, so this PR cannot govern that external action.

Related

ADR-298, ADR-304, ADR-328. Avoids the dependency and security-workflow surface of draft PR #1669.