feat(phase-26): add checklist item attestations and attestation notes

[xiwuqi]

Summary

This PR completes Phase 26: Cross-Run Audit Catalog Checklist Item Attestations and Attestation Notes.

It adds:

• a shared audit-catalog checklist-item-attestation contract
• attest / list-attested / inspect-attestation / clear-attestation / apply paths through existing SDK / API / CLI / web seams
• inline and queued integration coverage for attested presets
• Phase 26 docs, ADR, guide, and roadmap status sync

Stage Review Status

• Phase 26 has passed stage review
• this is a direct-to-main PR
• the branch is not a stacked branch
• Phase 27 must not start until this PR is merged into main

Scope boundaries

This PR does not change replay or approval source of truth.
It does not add broader checklist orchestration, broader review workflow engines, threaded comments, fine-grained RBAC, multi-tenant SaaS concerns, dashboards, analytics/search productization, payload persistence, copied artifact persistence, attachment-upload products, artifact vault behavior, or any Phase 27 work.
Provider-specific payloads, copied artifacts, and workflow-state snapshots do not enter the shared contract.

README is not a blocker for this phase, so this PR intentionally does not expand scope into README updates.
README.md line 19 can be handled later as a separate minimal docs sync item.

Validation

• changed-files Biome check
• git diff --check
• pnpm typecheck
• pnpm test
• pnpm test:integration
• pnpm build
• repo-wide pnpm lint verified in clean LF clone D:\Runroot-phase26-lintcheck-attestations-20260402-b

Lint note:

• pnpm lint in the current Windows worktree still reports repo-wide CRLF / formatter drift outside the Phase 26 diff
• the clean LF verification clone passes repo-wide lint with the Phase 26 changes applied