fix(ruleset): compare semantic update state

[rldyourmnd]

Outcome

Exclude pre-write writable_payload and writable_digest from the immediate semantic postcondition after a ruleset PUT.

GitHub necessarily returns a new writable serialization and digest after a successful update; comparing those to the old CAS evidence made every real update report partial even when all rules, bypass actors, conditions, identity, and enforcement matched.

The full fresh read-back is still recorded and subsequent Verify still compares it exactly.

Evidence

• regression proves only serialization evidence is ignored
• semantic rule drift still fails
• app/provider/ruleset suites
• quick Go validation
• portable synthetic fixtures only