feat(enterprise): validate semantic issue proposals

[seonghobae]

Buyer-visible gap

After #533, the package can deterministically parse explicit values but still lacks a provider-neutral trust boundary for semantic issue extraction. This PR advances #536 and #404 by validating untrusted semantic issue proposals against exact source text and compiling them into the existing enterprise evidence contracts.

Test-first state

The current head contains the approved design, implementation plan, and authoritative RED contract tests only. CI is expected to fail because EnterpriseSemanticIssueProvider, OfflineSemanticIssueFixtureProvider, extract_enterprise_semantic_issues, and the semantic proposal constants/module do not yet exist.

Required implementation

• exact source hash and Python Unicode-code-point count replay before provider execution;
• runtime-checkable provider protocol with exact revision fingerprint;
• deterministic offline fixture provider;
• strict bounded primitive proposal and assertion schemas;
• package-derived issue, source-span, counterevidence, and stakeholder-perspective identities;
• separate direct fact, inference, counterevidence, ambiguity, and stakeholder value-judgment roles;
• no retained source text or transient issue statement;
• no provider SDK, model call, scoring, calibration, ranking, utility, causal, sentiment, or queue arithmetic;
• 100% statement/branch coverage and public docstrings;
• APA 7 doctoring, changelog fragment, and rendered CHANGELOG.md;
• exact-head Python, Rust/PyO3, package, GPU-no-skip, fuzz, Security, SAST, review, and unresolved-thread gates.

Closes #536
Advances #404

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 280466dc-ca61-46e4-862c-2af8f404e5bc

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}