Bind sweep evidence to exact inputs

[zmaril]

Summary

• bind every new sweep report and ledger block to the exact corpus-lock bytes, generated grammar sources, and last committed grammar-input revision
• classify repository evidence as current, stale, or unbound in table, Markdown, and JSON status output
• bind the Rust canary ledger with a fresh locked 27,307-file sweep and give the canary full Git history for stable revision provenance
• keep debug status responsive while hashing the repository's large lock files

Verification

• cargo test --workspace --no-fail-fast
• ./tools/sweep-smoke.sh rust (including cached rerun stability)
• full locked Rust hydration: 1,000 packages / 27,307 source files
• full locked Rust sweep: 27,292 passed / 15 failed / 2 grammar gaps / 13 noise
• ./target/debug/treebank status --check: 1 current / 0 stale / 9 unbound
• actionlint .github/workflows/corpus-canary.yml
• targeted rustfmt --check, bash -n, and git diff --check