fix(verifier): report headings the ship gate reads

[cskwork]

roles/verifier.md told reviewers to head each lens ## Verifier report — <lens>. approve.sh ship (gates/_common.sh sdlc_lens_missing) accepts a VERDICT only under ### E2E, ### Side effects or ### Intent match, and any other #–### heading starts a new section. As a result, a report preserved unchanged, as the role asks, was refused at ship.

Found in a measured run

A compact feature (taskdesk complete <id>) ran on v0.27.0 + #30 at lazymode 4 with Codex gpt-6.1-sol high, in an isolated temp project with a read-only kit copy whose hashes were unchanged afterwards. It took 462 s. The external oracle first passed at 121.6 s. stats.sh gives these spans:

Span	Seconds
intent	0–92
build + first proof	92–117
fresh combined reviewer	122–330
evidence, QA guide, ship gate	330–420
commit, delivery, close	420–451

The reviewer used the role's ## Verifier report — E2E headings, with ### sub-headings inside each lens. The first ship approval was refused, and the agent searched gate source twice before restructuring evidence.md (the run's own evidence.md records "the first approval refused alternate reviewer headings"). That rework falls inside the 330–420 s span. This is one run; the share of time the fix saves is not measured.

Change

• The report template uses the gate's headings, ### <E2E | Side effects | Intent match>, and one sentence asks for #### sub-headings inside a lens.
• The provenance sentence now points at the template's Provenance, Inputs/source and Evidence lines, which already list each item it enumerated (IDs, author/reviewer relationship, revision + tree identity, recipe/upstream identities, input paths, commands, exit codes, log paths, deciding lines). This keeps verifier.md within its word budget: 2,422 → 2,420, with the budget lowered to match.
• gates/_common.sh is unchanged.

Validation

• New selftest case: a report in verifier.md's layout, with #### sub-headings, passes approve.sh ship.
  • With the previous verifier.md, the case fails: report heading no longer matches the ship gate's lens headings.
  • With ### sub-headings, it fails: ship refused a report in roles/verifier.md's own layout.
• Local macOS: gates/selftest.sh SELFTEST PASS, tests/test_runner.py OK, git diff --check clean.