Make UK weighted-total parity closed-world and artifact-identity-bound #774

The weighted comparator checks only intersecting keys and reports one-sided
keys without failing (tools/verify_uk_spine_parity.py:230-274). The caller
echoes optional identities without verifying them
(tools/verify_uk_spine_parity.py:365-383). A strict probe
compared {kept: 1, omitted: 2} against {kept: 1}, accepted an anonymous
reference filename and no candidate identity, reported
only_in_reference=[omitted], and returned parity with no unsigned difference.

Acceptance criteria:

• Require the complete expected total-key set on both sides.
• Verify both sidecars against full expected artifact/content identities and
  bind those identities into the receipt.
• Fail strict mode on every one-sided key, missing/wrong identity, and
  cross-artifact sidecar.

From the post-merge verification of #747 (round-1 review + fresh reproductions on merged main); full evidence: https://github.com/PolicyEngine/microcosm/blob/review/pr-747-audit/REVIEW-747.md

🤖 Filed by the microcosm owner session with Claude Code