fix(path): require exact fulfillment request correlation

Description

The pitch.

## Summary

Require a fulfillment's returned `request_id` to match the exact, nonempty order identifier Town issued and recorded as the event subject.

Previously, semantic evaluation accepted any identifier beginning with `order-`. A cached answer for a different run, with the expected total, could pass all six Path stages. The comparison now uses the actual issued identifier without coercion, and mismatch diagnostics include both expected and observed IDs while preserving the total check.

## Compatibility

The judgment change advances `PATH_EVALUATOR_VERSION` to `path-0.2`; the frozen profile is unchanged. Existing `path-0.1` bundles need their matching evaluator for replay. Their signatures are not invalidated by this revision, but the newer bundle verifier stops at the evaluator-version mismatch and does not complete their verification. A Proof gate requiring successful bundle verification will therefore refuse them until verified with the matching evaluator or replaced by a fresh run.

## Regression coverage

- Normal matching responses pass through the run and bundle-verification APIs.
- Stale `order-*`, unrelated, missing, null, and non-string response identifiers fail.
- Empty issued identifiers cannot satisfy correlation.
- Failure notes identify the actual observed value.
- Passing and failed results replay consistently.

## Verification

- `.venv/bin/python -m pytest -q tests/test_path.py`: 18 passed.
- `.venv/bin/python -m pytest -q`: 191 passed.
- `.venv/bin/nandatown run marketplace --out <temporary-dir>`: PASSED.
- `.venv/bin/nandatown run quote-crash-restart --out <temporary-dir>`: PASSED.
- `git diff --check`: passed.
- Python 3.12.13 locally; current CI also exercises Python 3.11. CI has no separate lint/format step.
- TDD reproduced the stale-order false pass before the fix. Independent expert correctness and vision review completed; review feedback strengthened edge-case tests.
- Combined integration with #233 and the other three correctness fixes: 213 tests passed on both Python 3.11.15 and 3.12.13.

Base: `projnanda/nandatown:main` at `4d57012a3dfb6b7aeee5ab429b26513a5eef4505`. This is an exact-request correctness fix, not a general A2A conformance or external-adoption claim.