Fix direct bounty evidence checklist issue 686

[praveenchand-2005]

What Changed

Add a deterministic, versioned direct-bounty evidence checklist for issue #686, aligned field-for-field with the canonical direct-evidence-checklist-v1 JSON schema (PR #688) so one versioned checklist is the source of truth.

• crates/domain/src/lib.rs: DirectBountyEvidenceChecklist with schema_version (const), bounty_id, submission_evidence, verification_evidence, payment_evidence and a validate() enforcing the schema boundaries (40-hex commit, GitHub repo/PR URLs, non-empty check-run URLs, https artifact, sha256/sha512 digest, 0x64-hex settlement tx hash).
• fixtures/evidence/valid.json / invalid.json: valid + invalid canonical evidence fixtures (verified against PR Add direct-bounty evidence checklist schema and validator (closes #686) #688's schema with jsonschema).
• Serde round-trip test proving the Rust model serializes to the canonical JSON shape.

Linked Bounty Or Issue

Issue #686 — direct-bounty evidence checklist. Maintainer consolidation direction (one versioned checklist as source of truth) applied by aligning to PR #688's canonical schema.

Maintainer Change Notice

not maintainer-owned

Acceptance Criteria

• Clear verifier/review path (domain validate() + schema fixtures).
• Deterministic behavior tested (cargo test -p domain --lib direct_evidence_checklist, 8 tests).
• Payment/settlement/payout behavior unchanged; checklist is evidence-only and cannot authorize payment by itself.

SDLC And Recovery

• Change class: R0 (new domain model + tests, no runtime payment paths touched)
• Authoritative source of truth: direct-evidence-checklist-v1 schema (PR Add direct-bounty evidence checklist schema and validator (closes #686) #688)
• Expected failure modes: malformed evidence rejected by validate()
• Idempotency or replay key: N/A (pure validation, no state)
• Rollback or forward-repair path: revert commit
• Health/readiness/SLO signal: domain tests
• Recovery fixture added: fixtures/evidence/valid.json + invalid.json
• Release/canary impact: none

Local Checks

cargo test -p domain --lib direct_evidence_checklist   # 8 passed
cargo test -p domain --lib                             # 31 passed, 0 failed

Review Lane

• If useful but not main-ready, I am comfortable with maintainers preserving this work on a collab branch for follow-up PRs.

Code review, CI approval, and collaboration-branch preservation do not approve bounty acceptance, payout, or payment settlement.

[NSPG13]

The PR is in the manual-security-review lane because it changes executable checklist behavior. What passed: it targets issue #686. What blocks main: it overlaps other checklist implementations and must prove deterministic schema compatibility. Action: run cargo run -p cli -- docs-contract-check and focused validator tests, then consolidate with #688 or #739 or explain the unique missing case. Done when one versioned checklist is the source of truth. Thanks for helping the community grow, and sorry for the review friction.

[praveenchand-2005]

Rebuilt this branch on top of current main and consolidated the checklist scope as the maintainer requested.

What changed

• Dropped the mixed scope from the old branch (the Maintainer notice: owner-only bounded-wallet cancel/refund and safe inventory replenishment #703 wallet change, the opportunities.rs cleanup, and the reconcile fix — the last now lives in main via Fix routed activation after settled bounties #778). This branch is now a single focused contribution: the versioned direct-evidence checklist for [DIRECT] Add a concise direct-bounty evidence checklist #686.
• Added a deterministic, versioned DirectBountyEvidenceChecklist in crates/domain/src/lib.rs with field-for-field serde alignment to the canonical schema in PR Add direct-bounty evidence checklist schema and validator (closes #686) #688 (schemas/direct-evidence-checklist-v1.json): schema_version (const agent-bounties/direct-evidence-checklist-v1), bounty_id, submission_evidence, verification_evidence, payment_evidence.
• validate() enforces the same boundaries as the schema: 40-hex commit, https://github.com/<owner>/<repo> repository, non-empty subdirectory, GitHub /pull/<n> URL, non-empty https:// check-run URLs, https artifact URL, sha256/sha512 digest with matching value length, and a 0x-prefixed 64-hex canonical settlement tx hash.

Schema compatibility proof

• fixtures/evidence/valid.json passes PR Add direct-bounty evidence checklist schema and validator (closes #686) #688's canonical direct-evidence-checklist-v1.json (verified with jsonschema).
• fixtures/evidence/invalid.json is rejected by that same schema (check_run_urls empty) and by the domain validate() (EmptyCheckRunUrls).
• Serde round-trip test asserts the Rust model serializes to the canonical JSON shape and back.

This makes one versioned checklist (direct-evidence-checklist-v1) the source of truth, expressed as JSON schema (#688) and as a Rust domain model that is serde-compatible with it.

Local check

cargo test -p domain --lib direct_evidence_checklist -> 8 passed; full cargo test -p domain --lib -> 31 passed, 0 failed.

Branch rebuilt from the old head to ebacee6 (force-push). This is a collaboration draft, not merge/payment approval.