Fix the three Codex findings on #2

[devYRPauli]

Problem

The Codex review on #2 reported three defects. All three are still on main.

• P1, runner.rs: a run with --scenarios records the corpus as wic-50 revision v1. Two different scenario sets therefore share one label.
• P2, result.rs: validate accepts documents that the published schemas reject. On main, validate exits 0 for each of these ten documents:
  • v3 with failure_class: null, cause: null, http_status: 0, forced: false, ports: [] or parameter_count_b: -1
  • v3 with no evidence_path
  • v2 with failure_class: "bogus"
  • v1 with a run_id or a cause
• P2, export.rs: evidence_path and cause.reference accept absolute local paths. The site copies them into results.json, results.csv and the HTML links.

Fix

• The runner names a corpus by its content. A run of the frozen catalog keeps wic-50 and v1. Any other scenario set gets id custom, and its revision is the corpus SHA-256. The measurement contract spec states this rule under T1.2.
• Every result is checked against the schema of its declared version. The check runs after serde, so the existing serde messages do not change. This moves jsonschema from dev-dependencies to dependencies. Cargo.lock does not change.
• annotate refuses a v1 result. The v1 schema has no cause field, so an annotated v1 file fails its own schema.
• evidence_path must be a relative path under evidence/. cause.reference must be an http:// or https:// URL or a relative repository path, with an optional #fragment. Each path segment must be non-empty, must not start with ., and must use only ASCII letters, digits, ., _ and -. The fragment uses the same characters.
• The site link builders no longer trim a leading /, because the validator now refuses one. One site fixture had a leading / in a reference. I removed it. The golden output does not change.
• The runner records failure.http_status only from 100 to 599, as RFC 9110 defines. An endpoint can answer 600 to 999. The v3 schema refuses those values, so without this change run writes a file that the new check refuses. The failure code stays http_error, and the evidence keeps the raw status.
• Both result writers check the serialized document against its schema before they write it. A writer and the schema can no longer drift apart without an error.
• README and CONTRIBUTING now say which versions each command accepts.

Testing

• cargo fmt --check and cargo clippy --workspace --all-targets -- -D warnings are clean.
• cargo test --workspace: 150 tests pass. main has 141.
• Each of the ten documents above exits 0 on main and exits 2 on this branch.
• All 187 tracked result files pass willitcall validate.
• willitcall site --results results/ gives output that is byte-identical to main.
• The CI results job (Python Draft202012Validator), the tools unittest and the redaction ledger check pass. The ledger check verifies 6 runs and 300 transcripts.
• A run against a mock endpoint that answers 600 writes a result that validate accepts.
• I removed each new check in turn and ran the tests. A test fails for each removal.
• The release binary grows from 7.9 MB to 12.3 MB because jsonschema is now a runtime dependency. site over results/ takes 0.05 s. main takes 0.04 s.