fix: trust host evidence for managed no-op delivery

[pcvantol]

Summary

• qualify a Managed no-op solely from the Execution Host's run-bound before/after repository observation
• prevent advisory provider SHA provenance from overriding host-verified delivery evidence
• cover the stale-producer-revision regression from the Forge E2E

Verification

• targeted managed no-op, invalid-evidence, and merge regressions
• full local EP test suite
• offline projection validation
• isolated wheel build, route ownership, and version consistency checks