test(evidence): add private witness end-to-end demo

[XiaoHai67890]

Change

• Adds a deterministic TOOL_TRACE private-witness demonstration from private input through commitment and an authorized ERC-8350 transition.
• Separates the public/on-chain record, private witness bundle, and auditor disclosure bundle.
• Adds a Foundry integration test that reproduces the same commitments and transition.
• Documents exactly what the auditor can verify and what remains outside the claim.

Acceptance evidence

• Public transition material: test-vectors/private-witness/tool-trace-v1.public.json
• Private witness boundary: test-vectors/private-witness/tool-trace-v1.private.json
• Selective audit disclosure: test-vectors/private-witness/tool-trace-v1.auditor.json
• Reproduction guide: evidence/private-witness/README.md

Verification

• pnpm demo:private-witness
• pnpm check
• 51 Foundry tests, 0 failed
• Clean-checkout conformance passed at 0f687913b9cfab44d141390c3a169ca505c049b9
• Raw tool arguments, salts, locator, and witness material never enter calldata

Scope

This is evidence and an optional audit workflow. It does not change the seven-field ExperienceDelta, transition hashing, Registry state machine, or ERC draft.

Stacked on #10 so this PR contains only the private-witness task.