Add the evidence vocabulary and read-outcome classifier (#409 S1) #490

Part of #409: slice S1 of the capability-aware diagnostics design (#485).

Scope

• korvid.core.capability:
  • EvidenceState, Basis, and the bases each state allows;
  • sources: ApiSource, DiscoverySource, ProviderSource and SourceScope;
  • Role, FreshnessPolicy and declarations;
  • Observation and the RunToken it carries;
  • conclusive;
  • EvidenceSet with baseline and by_scope.
• ReadRequest and classify, with bounded Status parsing.
• KubeClientError categories (timeout, transport, malformed, too_large). Each raise site on the shared request path sets its category.
• A table test that pins how Pulse's coverage states map onto the vocabulary.

Acceptance criteria

• Each state accepts only its own bases.
• conclusive is false for NO_DATA, for stale observations and for retention-limited sources.
• baseline is order-independent, and optional sources never lower it.
• The classifier implements the design's table for LIST, GET and discovery, including:
  • a 404 with and without a matching NotFound;
  • a 405 classified as stale discovery;
  • a 406 or 410 both inside and outside its context;
  • a failure after an accepted page classified as PARTIAL.
• Classification never parses error messages, and an error body over 16 KiB is not parsed.
• Nothing in core imports Textual or an optional extra, and tach check passes.

Out of scope: the discovery snapshot and resolution (S2), reads (S3) and run generations (S4).