fix(reliability): preflight detached autosave digest length before regex scanning

[seonghobae]

Current authoritative state

The original statement that detached digest preflight remained unbounded on Draft #184 is stale. Draft #184 remains the canonical single writer for src/autosave/evidenceValidation.ts; protected shipped truth is main@3b38ead2d00f44eb578d0689087b9293b3dabe1e and current exact #184 head is 62f406c2321492ce3161d2f72f45794bdfde9034.

#184 now explicitly Closes #214. Its test-first lineage records RED d7d8d879941fb08ec0597f394cc4d3a6e629a7de, where an otherwise-shaped 65-code-unit digest reached regex scanning, followed by GREEN 6d75be1826442531952c51698bf19e5ab54cfa53, which requires digestHex.length === 64 before the lowercase SHA-256 regex. Current production retains that preflight together with the #183 array/traversal resource repairs, descriptor-safe frozen-record validation and exact strong-ETag equality.

Current repair contract

• Reject non-64-code-unit digestHex before LOWERCASE_SHA256_DIGEST.test(...).
• Preserve accepted lowercase SHA-256 grammar and exact "sha256-<digest>" strong entity-tag matching.
• Preserve payload-redacted/null-returning failure behavior; do not reflect digest, tag or document content.
• Preserve descriptor-safe frozen evidence validation, bounded iterative traversal, framework-neutral packaging and standalone no-network/no-database/no-credential/no-model operation.

Evidence / integration boundary

Current exact #184 head is Draft and mechanically mergeable, but protected integration remains blocked by #118's v0.6.0 boundary plus then-live central workflows and qualifying independent approval. The PR body records current-head repository verification lineage but live workflow/review state must be freshly refetched before any lifecycle action; pending/queued/skipped/cancelled/absent/stale/predecessor/status-only/model-only evidence is non-passing.

Keep this issue open until #184 integrates under live governance. Do not create a competing evidenceValidation.ts writer, transfer predecessor evidence, self-approve, weaken gates, move protected main or claim active-PR behavior as shipped.