fix(receipt): verify evidence before rendering Town Proof

Description

The pitch.

## Summary

Require successful bundle verification before rendering Town Proof or automatically creating its receipt.

Previously, `proof` checked receipt signatures and two references but did not call `verify_bundle`. It could render `TOWN-TESTED` beside evidence that `verify` correctly rejected for tampering or evaluator-replay disagreement.

The new gate returns a clear “No Town Proof” reason when verification reports problems, leaves existing receipts untouched, and does not create a new receipt on rejection.

## Semantic boundary

`make_receipt` and `verify_receipt` are unchanged. Signed partial and failed receipts remain valid, independently verifiable commitments. Only the higher-level badge now requires the underlying bundle to pass verification. Signatures do not establish truth, observer independence, safety, or endorsement.

This is separate from #233, which refuses badges for incomplete coverage. The new positive fixture is fully covered through a normal pinned-card Path run, so the fixes compose without weakening that policy.

Companion #234 strengthens the bundle verifier's fingerprint binding. Merge #234 before this PR for the complete integrity chain; both PRs target main independently.

## Regression coverage

- Fully covered, fresh, verified evidence still renders the badge.
- Edited evidence is rejected with and without an existing receipt; existing bytes remain unchanged and no new receipt is created.
- Missing evidence returns CLI exit 1 with a reason, rather than attempting receipt creation.
- A bundle with valid signatures but an unreproducible verdict receives no badge.
- Partial receipts still verify independently.

## Verification

- `.venv/bin/python -m pytest -q tests/test_proof_integrity.py tests/test_receipt.py`: 11 passed.
- `.venv/bin/python -m pytest -q`: 188 passed.
- `.venv/bin/nandatown run marketplace --out <temporary-dir>`: PASSED.
- `.venv/bin/nandatown run quote-crash-restart --out <temporary-dir>`: PASSED.
- `git diff --check`: passed.
- Python 3.12.13 locally; current CI also exercises Python 3.11. CI has no separate lint/format step.
- TDD: the new regressions produced three false-badge failures and one missing-file failure before the production change.
- Independent expert correctness and scope review completed.
- Combined integration with #233 and the other three correctness fixes: 213 tests passed on both Python 3.11.15 and 3.12.13.

Base: `projnanda/nandatown:main` at `4d57012a3dfb6b7aeee5ab429b26513a5eef4505`. This gate inherits `verify_bundle`'s checks; it is not a comprehensive new validator.