fix(evidence): parse bundle revision from bundle check

[jeremi]

evidencectl build has been unable to complete since v0.21.0. It reads the
bundle revision out of the sibling evidence bundle-check stdout, but it
strips the wrong prefix: bundle-check prints

Evidence bundle <digest> passed check (N requirements)

while the parser looks for Evidence deployment , which is the deployment
check line (registry-evidence/src/main.rs:198). The prefix can never match,
so every real run ends at:

evidencectl: Evidence check returned no bundle revision

Why it survived three releases

The tests encoded the bug. The unit test fed the parser the deployment
format, and the integration stub at tests/production_build.rs:975 is a shell
script that printed the deployment format too. Nothing in the suite ever put
the real evidence binary on this path.

The change

• build.rs: strip Evidence bundle instead of Evidence deployment .
• tests/production_build.rs: the stub now prints what bundle-check
  actually prints.
• build.rs unit test: asserts the new format parses, and adds a negative
  case asserting a well-formed deployment line is now rejected, so the two
  formats cannot be confused again.
• tests/production_handoff.rs: adds
  production_build_accepts_the_real_bundle_check_revision, an #[ignore]d
  exact gate that drives the real evidence binary end to end. A stub cannot
  satisfy it.

Verification

cargo fmt --check                                                    pass
cargo clippy --locked -p registry-evidencectl --all-targets -D warnings   pass
cargo test  --locked -p registry-evidencectl --lib build::           4 passed
cargo test  --locked -p registry-evidencectl --test production_handoff \
  -- --ignored production_build_accepts_the_real_bundle_check_revision   1 passed

The new exact gate was also run with build.rs reverted to the old prefix and
everything else unchanged: it fails with evidencectl: Evidence check returned no bundle revision, the exact user-facing error. The gate catches the
regression it was written for.

Release context

This does not block the v0.24.0 candidate pipeline, which compiles and
packages evidencectl but never runs evidencectl build. It is being landed
ahead of the tag so v0.24.0 is not the fourth consecutive release shipping a
broken primary command; downstream tooling that drives evidencectl build is
blocked on it today.

Cherry-picked in isolation from codex/fix-evidence-build-revision-parser
(92293f861). None of the other 7 commits on that branch are included.