Work collector: reject substituted native PR/MR and issue identities #68

A selected work collector requests a specific native PR/MR or issue ref, but the returned record's number/iid was not compared with that requested ref. A malformed provider response could substitute another same-project object. The final MR/PR read checked head/update continuity, but not native identity, so a same-head wrong object could also pass the continuity check.

Acceptance: reject a mismatched native change identity on both initial and final reads for GitHub and GitLab; refuse a mismatched issue/dependency record; retain explicit missing evidence instead of substituting the returned object into selected or registered work. Add provider-shaped negative regressions without making unknown values healthy.