test(issue62): bind live capture correlation

[NOirBRight]

Summary

Refs #62. Evidence-only sidecar hardening from exact base 9ec0b9b5413b6861595c21fe8e213441e03a0b0e.

• Binds each pre/post sanitized capture record to an HMAC-derived correlation token propagated only across the isolated pre→post hop.
• Rejects prebuilt, missing, or mismatched capture bindings before forwarding and preserves bounded cleanup/error behavior.
• Adds a regression test for deterministic capture-ID binding and updates the implementation plan to document the required live binding arguments.
• Does not change production routing, telemetry, configuration, or release metadata, and does not claim 0.1.8 Beta2: Inventory Codex CLI 0.146 tool types and representative Responses lifecycles #62 qualification.

The companion manifest contract must consume and validate paired capture IDs; full planner, live wire controls, and qualification remain open under #62.

Exact head under review: 8f798c8cc4cdd5bc654b2c8fe645c9b4c96ab6a9.

Verification: py -3.13 -m pytest tests/test_issue_62_live_evidence_sidecar.py -q — 42 passed; git diff --check — passed.

No Beta2 tag or Release is created by this PR.

[NOirBRight]

Superseded by the completed #62 sidecar-correlation lineage and closeout recorded on Issue #62. Remote branch retained for history.