registry-evidence: cardinality guard, offline fixture exemption and traceability entries from the source-connection review

[jeremi]

Three items on the Evidence runtime from the review of the source-connection work.

1. validate_cardinality (crates/registry-evidence/src/kernel.rs) guards a derived view's cardinality only on reads that reach the relation. A view whose relation no question traverses is never checked, so a violation surfaces only when a question happens to reach it. Consider validating at bundle load.
2. SourceExecutor::new_for_offline_fixture (crates/registry-evidence/src/source.rs) exempts a source that names a connection from the shared-resources requirement (shared_resources may be None), while the connected constructor requires them. Either the fixture path should require the resources, or the exemption should be documented as the fixture contract.
3. products/evidence/contracts/security-test-traceability.yaml lists requirement_projection_prunes_unreached_connections_and_covers_selected_behavior under sec-source-request-immutable, which that test does not assert, and the V1-I09 no-deduplication clause is pinned only indirectly. Move the entry to the requirement the test asserts and add a direct pin for V1-I09.

Origin: review of PR #865.