fix(viewers): safely render evidence and rank only verified bundles

Description

The pitch.

## Summary

- Render participant-controlled viewer values as inert text, escape the HTML title/script-data boundary, constrain styles, and support the actual Path profile and empty timelines.
- Verify before ranking on the local board; keep bad evidence visible as unverified instead of silently hiding it or granting a result.
- Deduplicate identical bundles, use actual directory keys for recovered/renamed bundles, escape terminal control characters, and use committed evaluation time rather than Lab logical zero for chronology.
- Contain malformed verifier/loader errors at the board boundary so one bad bundle cannot hide good runs even before the companion hardened-verifier PR lands.

## Verification

Fresh standalone base: `53178b9c780d7a7dd6ce723131c4250de03908dd`.
- `python -m pytest -q` on Python 3.12 — 664 passed, 8 existing warnings.
- `git diff --check` — clean.
- Browser-DOM hostile-input regression failed against the original renderer and passed after safe text rendering.
- Current Path rendering, board ranking/deduplication, recovered directory selection, terminal control characters and chronology have behavioral tests.
- Independent review cleared the viewer/board changes. Standalone tests exposed a malformed-manifest exception from the older verifier; the added containment fixed all three failures.

The branch passes independently. Merge #261 first for its stronger underlying verification contract; no stack or rebase is required. A local verified ranking is not an independent observer endorsement. The final current-manual PR is #263.