Improve model adapter composition gates

[DENGXUELIN]

/claim #2066

Skill Improvement ($50-150 Bounty)

Related review issue: #2066

Summary

This improves model-supply-chain by adding adapter composition provenance gates so LoRA/QLoRA/PEFT adapters are assessed as the deployed composition of base model, adapter, tokenizer, quantization, merge order, runtime, safety evaluation, and rollback bundle.

Changes

• Add MSC-COMP-01 through MSC-COMP-08 evidence gates.
• Require composition manifests binding base model, adapter(s), tokenizer/config, quantization, target modules, rank/alpha, merge order, merge script/tool versions, compatibility constraints, signatures/attestations, safety regression evidence, and rollback bundle.
• Extend output with Adapter Composition Inventory and gate results.
• Add skill-local benign and vulnerable JSON fixtures.

Bounty Tier

• Minor ($50) - Small improvements, typo fixes, minor clarifications
• Moderate ($100) - Adds meaningful coverage, new validation gates, or useful fixtures
• Substantial ($150) - Major restructuring, broad new coverage, or comprehensive test suite additions

Validation

• git diff --cached --check
• git diff --check origin/main...HEAD
• JSON parse check for both fixtures
• Markdown fence balance check
• marker checks for MSC-COMP-01 through MSC-COMP-08
• added-line realistic-secret-pattern scan
• git merge-tree --write-tree origin/main HEAD matches HEAD^{tree}
• fork branch pushed and remote tree verified against local HEAD^{tree}

Payment preference

GitHub Sponsors, if accepted.