BReg evidence export: represent UUID, reference and vocabulary fields exactly in selectors and facts

`bregctl generate evidence-source` (the exporter in `crates/registry-breg/src/evidence_source.rs`) maps a `uuid` or `reference` field to a bounded string of exactly 36 characters, and a vocabulary code to a bounded string, both for selector profiles and for output facts. Evidence's selector contract has no UUID lexical type, and its Version 1 fact schema subset (the string arm of the schema validator in `crates/registry-evidence/src/bundle.rs`) admits `format: date` and `date-time` only and no `pattern`, so an exact validator is not expressible today.

Consequences:

- Selector side: a same-length value outside the domain passes Evidence's selector validation and reaches BReg, which refuses it with the audited `request.invalid` problem before any read (`validate_field_value` runs first). Evidence reports a source failure instead of a selector refusal.
- Fact side: a malformed value of the right length from a drifted source passes the response and fact-schema gates and can reach a signed assertion. The returned-identity check covers the identity field only.
- Vocabulary codes need the codelist artifact and its version, which the export does not carry.

Options, decision pending:

1. Extend the Evidence schema subset with a `uuid` format in its own registry-evidence change, and have the exporter emit it for `uuid` and `reference` fields in both selectors and facts. Recommended: small, closed, and serves both sides.
2. Refuse these field types as not losslessly representable and point at a custom adapter.
3. Keep the bounded string and document the limit in `products/evidence/reference/authoring-projects/SOURCE-EXPORT.md` and the exporter's output.

Vocabulary fields need the codelist artifact under any option, or a refusal. The tutorial registry uses string selectors and is unaffected.

Origin: review of PR #865 (raised by Codex, answered in-thread).

Inizia da crates/registry-breg/src/evidence_source.rs e dal validatore del braccio stringa in crates/registry-evidence/src/bundle.rs. Confronta la gestione di selettori e fatti per i campi uuid, reference e vocabulary, quindi determina quale opzione è prevista, incluso il modo in cui vengono trasferite le liste di codici di vocabulary. Il lavoro è completo quando il comportamento scelto è implementato in modo coerente su entrambi i lati e i casi non supportati sono gestiti esplicitamente.

Scritto dal modello di indicizzazione a partire dal testo della issue.