docs: define proof-carrying finding consumption

[PhysShell]

What changed

• adds docs/proof-carrying-findings.md;
• defines the Own.NET/OwnAudit ownership boundary for derivation certificates;
• records verification states, ingest and integrity policy, artifact storage options, SARIF mapping, markdown/dashboard presentation, baseline semantics, triage behavior, and cross-signal confidence;
• separates producer-claimed status from consumer replay through the official verifier;
• indexes the design in the root README.

Why

If Own.NET emits replayable derivations, OwnAudit needs a disciplined consumer contract. It must preserve and present the stronger evidence without flattening it into prose, silently trusting producer metadata, or growing a second verifier implementation.

Impact

Documentation only. No normalizer, verifier invocation, SARIF, dashboard, baseline, or gate behavior changes in this PR.

Validation

• reviewed the diff against the existing OwnAudit design-document style and repository boundary;
• branch is two commits ahead of main and touches only the new design document plus the README index;
• no code tests were run because this is a documentation-only design PR.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 7563369f-0f7f-4de9-b752-59adda5410ce

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch agent/proof-carrying-findings

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}