experiment: export doctor checks as portable evidence

[kvnloo]

Downstream-only producer slice for https://github.com/kvnloo/ace-digital-twin/issues/115.

Stacked on #1. Contract: https://github.com/kvnloo/ace-digital-twin/pull/116

Adds a privacy-preserving adapter around the existing selected-runtime doctor check. It records only driver, exit status, error type, repository, and exact revision; stdout/stderr are discarded.

No policy, sandbox, runtime-selection, telemetry, or security behavior changes.

[kvnloo]

Focused adapter validation passed independently for:

• selected runtime success -> pass;
• nonzero exit -> fail;
• timeout/unobserved result -> unknown;
• non-exact revision rejected.

This validates the stdlib normalizer semantics only. It is not being treated as proof that the combined OpenShell runtime stack passed; repo security checks remain separate.

[kvnloo]

Portable Evidence Adapter run 36679461604 caught a test bug, not an adapter leak.

The privacy test searched the entire serialized receipt for the substring command, which matched the invariant name portable-evidence-excludes-command-output. The evidence details themselves contained only driver, returncode, and error_type.

Fixed at 779f76b385863e04211e299561cbb797dde54c47 by asserting the exact allowed details-key set. The GitHub-native adapter job is rerunning on that head.