Document bounded Correctover / CCS external interoperability findings

[RobLe3]

Purpose

Preserve the Correctover / CCS September 28 report as bounded external MCP-gateway composition evidence. This is documentation and informational tracking only, not protocol adoption or qualification credit.

• Add a sanitized evidence record with actual versions (Python SDK 0.7.109; verifier 1.3.0), the 14/14 expected case outcomes and 415/426 checker checks, missing reproduction artifacts, trust boundaries, licensing and measurement limits.
• Correct the report's suggestion that both receipt models were detached-signed: the released Python policy receipt is unsigned.
• Add a link from the existing external-evidence participation page without changing its campaign lanes.
• Update only that navigation document's working-branch integrity pin and add the new note's pin; preserve published v1.10.17 and all release/version boundaries.

Tracking

• IICP #256: generic composable execution-assurance evidence, correlation/completion questions, future full-chain experiment and SDI relevance. Deferred until after qualification; no schema implementation.
• Python SDK #142: intended trust scope of the actual tested gateway policy receipt. Unsigned is not automatically a defect; signing needs its own justified trust requirement.

Existing architecture and completed research are linked, not reopened. No CCS dependency, source import, vocabulary change, candidate/support-matrix/qualification-state change, release, production change or standards submission.

Local validation

PASS:

• python3 tools/generate_implementations.py --check
• python3 tools/check_protocol_comparison.py
• python3 -m unittest discover -s tools -p 'test_protocol_comparison.py' (31 tests)
• Both test_selection_review_bundle.py and test_standards_review_bundle.py suites
• python3 tools/check_spec_release_integrity.py (270 working-branch pins)
• python3 tools/check_public_artifact_closure.py --all-public (530 artifacts)
• Required strict public-prose checks and changed-document checks (style advisories only)
• git diff --check

Draft / not merge-ready: bash tools/run_profile_fixture_contract.sh stops on a pre-existing local multi-repository source-inventory discrepancy: the current PHP installed-discovery script is not yet dispositioned in the existing intent-source catalogue. The same failure was reproduced with the original main auditor and registry catalogues against the unchanged workspace. No catalogue was regenerated to hide it. All 38 remaining fixture-script commands were run separately and passed; this does not turn the original full gate into PASS.

The initial bare-environment run also lacked the local conformance-runner package; the documented isolated IICP environment resolves that setup failure. No CCS package was installed. Raw experiment receipts/checker output remain unavailable, so IICP did not reproduce or certify the external execution claims.

This PR is deliberately draft pending review and normal validation closure; it does not add a blocker to the active qualification programme.