security(attestation): bind immutable artifact size in scientific-validation receipt #2314

Finding

Issue #2299 requires the scientific-validation owner contract to bind same-run immutable GitHub artifact ID, name, size, and digest metadata before signer authority exists. Current PR #2300 binds artifact ID/name/digest into both the unsigned predicate and versioned receipt manifest, but omits GitHub REST size_in_bytes entirely.

That omission leaves the future signer handoff unable to prove that its receipt refers to the exact live artifact metadata tuple required by #2299. GitHub's Actions artifact API exposes id, name, size_in_bytes, digest, and workflow-run identity as independent artifact metadata; size must therefore be carried as an authenticated control value rather than inferred from the extracted JSON member or ZIP payload bytes.

RED / acceptance

Add owner-level contracts proving that:

• one positive-decimal evidence_artifact_size_in_bytes control is required;
• the generated scientific-validation predicate commits the exact artifact size alongside artifact ID/name/digest;
• the versioned completion manifest commits the same size and validate_receipt_manifest rejects a syntactically valid size that conflicts with the committed predicate;
• zero, signed, fractional, or non-decimal sizes fail closed;
• size is treated as GitHub artifact metadata and is not recomputed from the extracted evidence JSON byte length;
• current strict schema, no-clobber publication, predicate-byte commitment, execution-artifact ordering, and scientific does_not_prove boundary remain unchanged.

Because no scientific-validation owner contract has been released or immutable-pinned yet, repair the still-unreleased v1 predicate/manifest before first release instead of creating compatibility debt solely to preserve an unpublished omission.

Do not claim signer/OIDC authority from this repair. #2164 and #2299 remain the authentication/signing path; TEPP #637 must continue to wait for released/pinned authenticated owner authority.

Refs #2299 #2300 #2164 ContextualWisdomLab/TEPP#637.