[DIRECT] Add a concise direct-bounty evidence checklist

[joan-bisbal]

Closes #686 - Adds DirectBountyEvidenceChecklist to crates/domain/src/direct_bounty.rs with SubmissionEvidence, VerificationEvidence, PaymentEvidence structs, full validation (rejects empty fields, non-HTTPS URLs, mutable artifact references), and 12 unit tests. No external dependencies added.

[NSPG13]

Maintainer compatibility pass before today's bounded-wallet reconciliation fix:

• The contributor-safety/docs-contract gate passed.
• This PR changes runtime code, so it still requires its normal line-by-line behavior and security review before main readiness is decided.
• It does not overlap the planned narrow fix in site/agent-budget.js and its focused regression test. That fix only waits for confirmed Base allowance state after a receipt and does not change contracts, payment amounts, or the PR's public contract.

No rebase or contributor rework is requested because of today's maintenance. I will evaluate this PR's own acceptance criteria separately and give specific commands/files if changes are needed.

[NSPG13]

The PR is in the manual-security-review lane because it changes executable checklist behavior. What passed: it targets issue #686. What blocks main: it duplicates the evidence-checklist work in #688, #739, and #745. Action: please consolidate into one PR or explain the unique acceptance gap; run cargo run -p cli -- docs-contract-check and focused validator tests; include fixtures for invalid and valid evidence. Done when one versioned checklist is the source of truth. Thanks for helping the community grow, and sorry for the review friction.

[joan-bisbal]

This PR addresses a unique scope for issue #686, specifically focused on direct-bounty evidence checklist enforcement. It does not conflict with the mentioned overlapping PRs. We have added the required valid and invalid fixtures.