Clarify manifest and runtime evidence boundary

[imran-siddique]

What changed

• Defines artifact 7 as the decision-log baseline captured at manifest issuance
• States that later decisions are separate TRACE or OCSF evidence records
• Documents the identity, key, and chain-continuity join between deploy-time and runtime evidence
• Removes claims that a deploy-time manifest proves decisions produced later
• Clarifies that a signed runtime record proves integrity, not completeness or behavioral correctness

Why

The previous overview blurred deployment identity with runtime evidence. That contradicted the boundary developed through CoSAI RFC #149 review: the manifest proves what was authorized to run; linked evidence records describe what happened afterward.

Validation

• 95 focused binding and verification tests passed
• Documentation build completed content generation but strict mode reported 12 pre-existing link/nav warnings unrelated to this change
• Ran git diff --check