[AIAA] Build step 6: provenance check

[nate-double-u]

Build step 6 (spec section 16, PR #363): CI that fails a deliverable PR
whose provenance block (section 15) is missing or malformed. A workflow
in .github/workflows/ backed by a unit-tested script in
scripts/assessment/.

Done when:

• Unit tests cover the malformed, unfilled, and well-formed block
  shapes and the draft-versus-ready leniency (section 15).
• The step's own draft PR exercises the workflow wiring live.

Strict rules once a PR is marked ready: resolved methodology SHA that
matches the phase A pin, listed data paths present in the tree, final
form disclosure, filled verification record, verified label. A
hand-written deliverable passes with none in the agent fields only;
the evidence rules still apply (HC-5, HC-7).