fix: bound native structural evidence

[abrichr]

Summary

• bound retained accessibility strings and ancestry while omitting oversized identity fields instead of truncating them
• make the versioned observation envelope provider-extensible without claiming another shipped observer
• document the local-only boundary and current Windows-only emission

Existing integration preserved

• the existing Recorder remains the sole native recorder
• Windows UIA capture from PR Capture Windows UIA evidence with native actions #45 is unchanged functionally
• Flow continues to admit only provider windows_uia for native Windows and excludes local UIA for external RDP/Citrix captures
• unavailable or invalid structural evidence still falls back to the existing pixel capture

Verification

• 337 passed, 1 skipped, 8 deselected: fast suite excluding browser bridge and slow input injection
• 11 passed, 1 skipped: focused structural and real-Windows smoke modules (Windows live case skips on macOS)
• Ruff check passed
• wheel and sdist built; scripts/verify_distribution.py passed both archives