[AIAA] Build step 6: provenance check

Build step 6 (spec section 16, PR #363): CI that fails a deliverable PR
whose provenance block (section 15) is missing or malformed. A workflow
in `.github/workflows/` backed by a unit-tested script in
`scripts/assessment/`.

Done when:

- [ ] Unit tests cover the malformed, unfilled, and well-formed block
shapes and the draft-versus-ready leniency (section 15).
- [ ] The step's own draft PR exercises the workflow wiring live.

Strict rules once a PR is marked ready: resolved methodology SHA that
matches the phase A pin, listed data paths present in the tree, final
form disclosure, filled verification record, `verified` label. A
hand-written deliverable passes with `none` in the agent fields only;
the evidence rules still apply (HC-5, HC-7).