security(attestation): read sealed scientific evidence once before attestation #2302

Finding

Fresh review of PR #2300 confirms a TOCTOU integrity defect in the unsigned scientific-validation verifier. The verifier currently hashes evidence_path via _sha256(evidence_path) and then reopens the same pathname via _load_document(evidence_path) for size/UTF-8/JSON/schema validation. A path can therefore change between the digest read and the semantic-validation read. In the hostile case, bytes A can be hashed and later attested while bytes B are the bytes actually parsed and validated.

This is not a psychometric-policy defect. It is an owner-boundary integrity defect in the future attestation foundation. The causal repair should open the validated evidence member exactly once without following symlinks, require the opened descriptor to be a bounded regular file, read bounded bytes once, and use those exact bytes for both SHA-256 and strict JSON parsing. Preserve the one-member sealed-root contract and existing schema/binding checks.

The same fresh review also found a coverage debt: _atomic_json retains a leaf-symlink guard, but the current selected 100% branch-coverage tests reach the earlier _validate_output_path symlink refusal rather than the _atomic_json guard itself. Add a direct hostile contract for that branch instead of deleting the defense.

RED / acceptance

1. Add a deterministic hostile test that starts with invalid/malicious bytes A whose SHA-256 is the supplied evidence digest, swaps the pathname to valid bytes B only when a second path-based content read is attempted, and requires verification to reject rather than attest A after validating B.
2. Add a direct _atomic_json symlink-output test and require no target mutation.
3. Minimal repair: one descriptor / one bounded byte read for digest + parse; no source execution, no schema weakening, no caller-controlled trust expansion.
4. Preserve 100% owned branch coverage and docstring coverage in the existing Scientific Validation Evidence Quality workflow.
5. Do not claim hosted GREEN until the repaired exact-head generation is terminal.

Refs #2299 #2300 #2301 #2164 ContextualWisdomLab/TEPP#637.