Validate bounded cross-file artifact references

[Chumaniac]

What changed

Add bounded reference_exists checks for physical CSV deliveries. A citation ID must exactly match a declared unique string ID in another CSV; missing references and reference-capacity overflow become findings. Findings omit original IDs. README, contract documentation and a synthetic citation fixture describe the source capability.

Safety boundary

• No credentials or private contents were added.
• No new network, runtime execution or host mounts were introduced.
• Reference indexes hold only SHA-256 fingerprints and row numbers, with a 100,000-cell ceiling.

Verification

• 559 tests passed; one opt-in Docker test skipped.
• Type check, lint and build passed.
• Package dry-run includes the new runtime, contract fixture and documentation.
• The synthetic reference-integrity CLI scenario passes.

Documentation

• README, artifact contract documentation and changelog updated.
• Source and public npm release remain separate claims; this PR does not publish a package.