Retain canonical Swift entrypoint qualification evidence

[DavidBakerEffendi]

Description

Extend the bounded canonical diagnostics to the Swift entrypoint pair, with a separate prospective runner and plan committed before execution. Retain the original canonical bytes, metadata/population joins, source archives, and separate vendor-native/adapter-assisted observations. Refs #220 and #215; both issues remain open and acceptance is incomplete.

Key Changes:

• Both argv getter reads are recognized in the assisted lane, but only the marked indexed source at line 5 flows to the command-array sink at line 6 in the positive case. The constant-command negative has no canonical or auxiliary flow. Vendor-native retains two sinks and zero sources/flows in each case.
• Add portable evidence verification and 17 focused tests, including guard-only substitution and hidden negative auxiliary-flow controls. Extractions completed in 101.92/102.97 seconds under the 150-second cutoff; query limits remain 60 seconds/2048 MiB. Aggregate memory and semantic completeness remain unproven, and all observations remain non-scored with activation pending.

Touch Points:

• adapters/codeql/swift-native-v3/entrypoint-qualification-plan.json
• scripts/run-swift-entrypoint-qualification.py
• scripts/verify-swift-entrypoint-qualification.py
• scripts/test-swift-entrypoint-qualification.py
• evidence/swift-entrypoint-qualification-v1/
• docs/swift-entrypoint-qualification.md
• docs/src/content/docs/swift.md
• .gitattributes and .github/workflows/ci.yml

Validation: portable entrypoint verifier and all 17 tests pass from a clean Git archive; existing canonical source–sink verifier and pending integration verifier pass; cargo fmt --check and git diff --check pass. Independent bounded review found no blocking issues. Prior hash-bound runners, plans, evidence, fixtures and reports remain unchanged. No fixture binaries, full-corpus runs, scored activation or publication.