Harden manuscript readiness validation

[eightmm]

Summary

• bind review-ready source bundles to validated review packets and exact receipt coverage
• validate claim-local citations, JSON scalar locators, reporting-guideline consistency, and submission review coverage
• harden shared review-receipt parsing and align reviewer-runtime semantics

Root cause

The initial manuscript package validator mostly checked declared hashes and IDs. A stale or incomplete review could therefore remain apparently valid when source-manifest semantics changed, review modes were lowered, citation anchors were absent, or malformed receipt fields reached runtime paths.

Compatibility

This intentionally tightens schema-v1 readiness semantics. Existing packages remain readable but may return new findings until review packets, receipts, and hashes are regenerated. target_venue: null means internal handoff readiness, not venue compliance.

Test plan

• uv run python -m unittest tests.test_evidence_review_v2 tests.test_reviewer_runtime tests.test_manuscript_package tests.test_native_skill_quality — 48 passed
• ./scripts/check.sh fast — 350 passed; all release and contract gates passed
• independent adversarial source packet/receipt review — GO
• independent final diff review — GO