test(af02): prove T037 corpus bijection bounds and no-PHI
AF-02 Stack A1 T037 implementation slice.
Drives the real verifier binary (validate-corpus-assertions) over the checked-in corpus manifest, assertion registry, frozen corpus schema, and surface policy. Proves scenario/assertion cardinality equality, unique scenario/assertion/replay identities, frozen 256 KiB per-fixture and 8 MiB aggregate limits, contains_phi=false for every scenario, and that tampered corpus or registry bytes fail closed.
Single new test file under crates/commandf-pkg/tests. No product source, workflow, policy, schema, verifier, corpus-data, or ruleset change. Independent of PR #89; targets canonical main c56d961.
Summary by cubic
Adds a test that drives the real verifier over the checked-in corpus and assertion registry, proving the corpus stays within frozen size limits, has unique identifiers, contains no PHI, and that tampering fails closed. No product code changes.