Expose governance_scope/crypto_enforced in evidence, harden normalization, and include governance flags in run summary

[SDL-HQ]

Motivation

• Ensure governance metadata is captured and verifiable in certificates and evidence artifacts for SIR v2.2 semantics.
• Harden obfuscation/normalization to detect additional encoded attack markers (hex markers and more base64 gate phrases).
• Surface policy flags and observed governance context in run summaries so generated certificates and downstream tooling can rely on the governance state.

Description

• Added governance_scope and crypto_enforced to the evidence contract schema in spec/evidence_contract.v1.json and included them in generated certificates in tools/generate_certificate.py.
• Extended normalization in src/sir_firewall/core.py to recover additional base64 gate keywords and to decode bounded hex: markers and \xNN escape sequences while avoiding decoding arbitrary hex runs.
• Populated governance_context in validate_sir with default governance_scope and crypto_enforced fields and allowed pack identity to enrich that context.
• Updated red_team_suite.py to observe governance_context from validate_sir, compute summary_flags, and include governance_scope and crypto_enforced in the run summary JSON.
• Added release notes docs/release-notes-2.2.md describing highlights and semantics changes.
• Added and adjusted unit tests in tests/test_normalization_hardening.py and tests/test_pack_binding.py to cover hex decoding, hex-escape decoding, base64 gating, and summary/certificate flag behavior, and updated imports/mocks to ensure load_domain_pack is used consistently.

Testing

• Ran unit tests with pytest -q targeting the changed modules, including tests/test_normalization_hardening.py and tests/test_pack_binding.py, and they passed.
• Verified red_team_suite produces a proofs/run_summary.json containing flags, governance_scope, and crypto_enforced in test scenarios via the updated tests.
• No failing automated tests were observed for the modified code paths.

---

Codex Task