Report the first failed generated-image evidence check without exposing input data #403

Generated-image evidence checks return the same generic failure for an inaccessible evidence file, invalid JSON, an incompatible content review, and failed original provenance. This makes it easy to blame a later condition that was never reached.

Add an opt-in, read-only diagnostic to the existing evidence check. It must use the same guard and verifier, stop at the first failure, emit only fixed stage/reason codes, and never disclose paths, native records, image data or internal errors. It must not register evidence, create keys, relax classification or imply UI approval. Keep the default check/register response compatible.

Acceptance: a healthy synthetic control validates; denied evidence performs zero reads; read/schema/scope/native failures remain distinct; a truthful non-fictional declaration remains rejected by the current contract with an explicit reason; diagnostic output does not register or change original evidence; default CLI behavior is preserved. This diagnoses an unmet qualification and does not claim support for real owner data or resolve any particular asset.