feat: bind v6 advisory artifacts to input digest

[Pigbibi]

Summary

• require a lowercase SHA-256 input_digest on v6 advisory reports while keeping v5 unchanged
• propagate the v6 digest into report manifests and keep it out of semantic content identity
• document the v5/v6 dual-read migration and add a checked-in v6 contract fixture

Safety boundary

• current CLI and scheduled workflows remain v5 producers
• no broker, portfolio allocation, or live behavior changes
• malformed or incomplete v6 artifacts fail closed

Validation

• python -m pytest -q (309 passed)
• ruff check on changed Python/tests
• git diff --check