docs: require candidate and completion evidence

[pekth]

Copied test files can land outside the package, and a successful build or installation can be mistaken for a completed release. Require contributors to verify candidate paths and hashes, check that the intended tests actually ran, and report evidence separately for build, launch, installation, native UI, and publication.

Keep the detailed checks in CONTRIBUTING.md, link them from AGENTS.md, and update the knowledge index. Application code, build scripts, and release workflows are unchanged.

Validation:

• Documentation links and heading anchors resolve.
• The documented SHA-256 check accepts a matching candidate and rejects both a misplaced test file and a stale baseline.
• Diff checks and the repository pre-commit credential/path scan pass.
• Review-bundle and Ponytail review found no blocking issue. These are contributor checks; no automatic enforcement or native runtime proof is claimed.

Model(s): GPT-6-Astra; Jev 1.13.0 for typed review checks.
Harness: T3 Code through the Codex harness.