kernel: write_verify_evidence hardening — self-validate the record at write time, typed error for malformed code_identity

[SollanSystems]

Two deferred findings from the Slice 2 whole-branch review (PR #94):

1. The writer never validates the record it writes: run_id="" or attempt=0 produce a schema-invalid evidence record on disk that only fails later at doctor. Every other schema'd emit writer validates at write time (append_receipt → _validate_record). A basic-mode validate before the record write would also keep the failure inside the pre-os.replace window. (Not reachable from dispatch_once, which always passes well-formed values.)

2. A malformed code_identity mapping raises a bare KeyError: 'code_digest' out of the public writer — an untyped escape from a module contracted as typed-fail-loud. (Not live: the two loop.verifier constructors are the only callers today.)