evidence-cilisted

# /specseal:evidence-ci — put the drift check in CI The ledger only earns its keep when something checks it without being asked. Run by hand, the check gets run right after you already remembered the coordinates — which is the moment you least need it. This vendors `evidence_check.py` into the repo and writes the workflow. Both files are committed, so CI does not depend on the plugin being installed on any machine. ## Why vendored rather than fetched Fetch-at-run would tie every CI run to a network round trip and to whatever version the source happens to serve that day. A vendored copy makes the run deterministic and offline-safe, and puts the checker in the diff where a reviewer can see it change. The cost is that updates are a deliberate re-run of this command, not something that arrives silently. ## Procedure 1. **Locate the checker.** It ships at `<plugin root>/skills/evidence-check/scripts/evidence_check.py`. Resolve the plugin root from this skill file's own path rather than asking the user — the point of this command is that no one should need to know where the plugin lives. 2. **Check what already exists.** If `tools/evidence_check.py` or `.github/workflows/evidence-check.yml` is present, diff against what you would write and show it. Overwrite only on the user's say-so; an edited workflow may carry deliberate changes (a different path filter, a schedule, a dropped `--strict`). 3. **Vendor the checker** to `tools/evidence_check.py`, cre