[process-gap] verify changelog attestations against impl on each Pass — POL-001-verify-attestations

## Problem

Story changelog entries can attest to changes that did not actually land, and no gate re-verifies attestations against the impl they reference. Discovered in switchboard-blue S-6.05 v1.5 changelog: an entry read "AC-002 test name corrected to match implementation" — but the impl symbol named in the AC did not exist in the test file. The actual symbols in the file are `TestSVTNManager_Destroy_KeyPurgePostcondition` (line 1628) and `TestSVTNManager_Destroy_ConcurrentAdmissionIsRaceFree` (line 1835); the symbol the changelog claimed to have "corrected to match" (`TestSVTNManager_Destroy_KeyPurgeUnderConcurrentAdmission`) was never created. The false attestation cleared spec-steward review, cleared Pass-3 adversary review, and only surfaced when a fresh-context Pass-4 adversary spot-checked the impl symbols. This is a systemic shield: any changelog line asserting an impl-side or evidence-side change without in-band re-verification can slip past every gate.

## Impact

Governance drift accumulates silently. Late detection (Pass-4 here) means multiple downstream artifacts already carry the drifted anchor: BC/VP/index rows citing the wrong story version, sibling test names propagated forward. The retraction pattern is expensive — a v1.5 retraction changelog line, then v1.7 corrective bump, then POL-003 sync-burst across BC + VP + STORY-INDEX + VP-INDEX + BC-INDEX + sprint-state.

## Proposed policy (POL-001-verify-attestations)

Every changelog entry that CLAIMS a change to impl symbols, test symbols, file locations, or externally-verifiable evidence MUST include one of:

1. An inline citation `→ verified at :` at the tail of the entry, OR
2. A dedicated `verified_by: ` frontmatter field, OR
3. A `[UNVERIFIED]` marker if the change was made blind — which then triggers the next adversary pass to verify.

**Enforcement candidates:**

- `spec-steward` gains a "grep-attest" sub-check: for every changelog line matching `/corrected|renamed|amended|updated to match/`, require one of the three markers above, or fail the burst.
- `adversary` gains a "corroboration axis" per-pass: each Pass-N attempt must re-verify at least one changelog attestation from the immediately-prior version. Result rolls into the streak.
- (Lighter alternative) Add to the pass-4-and-onward-only checklist so it does not burden every pass.

## Sibling / cross-refs

- #382 (doc-comments asserting behavior not verified) — code-side sibling; this is the spec-changelog-side analog.
- #396 (spec-steward citation-corpus sweep on BC-bump) — same rough class (drift catch), different trigger.
- #425 (adversary corroboration-inversion) — related but different mode (adversary-side hallucination).

## Concrete evidence (in-tree, switchboard-blue)

- Story: `.factory/stories/S-6.05.md` v1.5 changelog entry, prior to v1.7 retraction.
- Adversary Pass-4 report: `.factory/cycles/cycle-1/adversarial-reviews/S-6.05-adversary-pass-4.md` (finding F-P4L2-HIGH-1).
- Impl symbols verified: `internal/svtnmgmt/svtnmgmt_test.go:1628` (`TestSVTNManager_Destroy_KeyPurgePostcondition`) and `:1835` (`TestSVTNManager_Destroy_ConcurrentAdmissionIsRaceFree`).

## Severity

**MEDIUM.** No production-safety impact (spec-only drift), but the class-of-shield is broad: any impl-related attestation that misses re-verification can propagate silently through the governance chain.