BReg evidence export: represent UUID, reference and vocabulary fields exactly in selectors and facts

`bregctl generate evidence-source` (the exporter in `crates/registry-breg/src/evidence_source.rs`) maps a `uuid` or `reference` field to a bounded string of exactly 36 characters, and a vocabulary code to a bounded string, both for selector profiles and for output facts. Evidence's selector contract has no UUID lexical type, and its Version 1 fact schema subset (the string arm of the schema validator in `crates/registry-evidence/src/bundle.rs`) admits `format: date` and `date-time` only and no `pattern`, so an exact validator is not expressible today.

Consequences:

- Selector side: a same-length value outside the domain passes Evidence's selector validation and reaches BReg, which refuses it with the audited `request.invalid` problem before any read (`validate_field_value` runs first). Evidence reports a source failure instead of a selector refusal.
- Fact side: a malformed value of the right length from a drifted source passes the response and fact-schema gates and can reach a signed assertion. The returned-identity check covers the identity field only.
- Vocabulary codes need the codelist artifact and its version, which the export does not carry.

Options, decision pending:

1. Extend the Evidence schema subset with a `uuid` format in its own registry-evidence change, and have the exporter emit it for `uuid` and `reference` fields in both selectors and facts. Recommended: small, closed, and serves both sides.
2. Refuse these field types as not losslessly representable and point at a custom adapter.
3. Keep the bounded string and document the limit in `products/evidence/reference/authoring-projects/SOURCE-EXPORT.md` and the exporter's output.

Vocabulary fields need the codelist artifact under any option, or a refusal. The tutorial registry uses string selectors and is unaffected.

Origin: review of PR #865 (raised by Codex, answered in-thread).

Start with crates/registry-breg/src/evidence_source.rs and the string-arm validator in crates/registry-evidence/src/bundle.rs. Compare selector and fact handling for uuid, reference, and vocabulary fields, then resolve which option is intended, including how vocabulary codelists are carried. Done means the chosen behavior is implemented consistently on both sides and the unsupported cases are explicitly handled.

Written by the indexing model from the issue text.