add vrg-ci-evidence bundle command (#2312)
Wire the merged lib/ci_evidence pieces into a runnable vrg-ci-evidence bundle CLI: resolve the release PR and its validated head SHA, select the qualifying CI run, download and parse the ci-evidence- artifacts, derive the required gates from branch protection, enforce completeness, then stage metadata, build and write the manifest, and assemble the tar.gz plus a standalone manifest. main is a thin orchestrator; each stage is a call into lib.ci_evidence. Adds the resolve_required_gates, load_gate_evidence, load_harvested_gates, and write_manifest lib helpers so no business logic lives in the CLI. --generated-at is caller-injected for determinism; IncompleteEvidenceError and NoQualifyingRunError map to a non-zero exit via emit_error. Registers the vrg-ci-evidence console script. Ref #2311.