Verify incomplete Polymarket candidate evidence without weakening complete evidence

[proerror77]

Parent

#314

Change contract

Add an independent candidate verifier in ploy-market-data that reuses the existing bound-directory, bound-FD, digest trust-anchor, and row-semantics checks to authenticate an event-local candidate triplet. It may report missing surfaces from verified bytes, but any present corrupt or contradictory surface fails closed. Existing complete-evidence seal, verify, set, and snapshot APIs keep their current strict rejection behavior.

Acceptance criteria

• A candidate has at least one valid market_contract; Up book, Down book, trades, reference, and settlement may independently have zero rows.
• Typed event-local coverage is derived from validated bytes, never producer state, surface status, or reasons; all five coverage keys are always present and missing surfaces have count zero.
• A present corrupt, mismatched, or contradictory surface is rejected and never downgraded to absent.
• Wrong content/manifest trust anchor, forged _SUCCESS, symlink/FIFO, open-after-bind mutation, and directory/inode replacement remain rejected.
• A complete candidate reports all five surfaces.
• Existing seal_polymarket_evidence_triplet still rejects missing settlement and existing verify_polymarket_evidence still rejects any required missing surface.
• The implementation reuses one shared authenticated-byte read seam; it does not copy or weaken filesystem trust-boundary logic.
• Focused counterexamples and the full existing Polymarket evidence test group pass.

Blocked by

#336

Out of scope

BTC/SOL or task capability policy, authoritative receipt/catalog append, catalog queries, OSS download/client behavior, snapshot/cohort construction, evaluator/MCTS behavior, and deployment.

Merge order

Merge #336 first. This issue is then an independent ploy-market-data rollback unit and must merge before #319.

Focused validation

cargo test -p ploy-market-data polymarket_evidence::artifact::tests::seals_authenticated_candidate_triplet_with_missing_surfaces --locked -- --exact
cargo test -p ploy-market-data polymarket_evidence::verified::tests::candidate_verification_reports_event_local_surface_coverage --locked -- --exact
cargo test -p ploy-market-data polymarket_evidence::verified::tests::candidate_verification_rejects_corrupt_present_surface --locked -- --exact
cargo test -p ploy-market-data polymarket_evidence --locked

Rollout / rollback impact

No runtime cutover. Rollback removes only the candidate verifier API; the complete evidence contract remains unchanged either way.