feat(model): shipped joins the evidence vector as a within-tier weight; v5 baseline

v5 (parameter-fed carried confirmed by the exact flow): pmpro 69, wpstatistics 172, mwwpform 68,
vampi 16. Reading the recorded head of each order: every region ahead of a CVE is in its tier on a tied
or higher score, and 10 of the 67 ahead of MW WP Form's are test-mail.php. The build's own word on what
is product was on the region and not in the vector; it is now, at -2.0 for an unshipped file. Orders
only, never promotes.

Co-Authored-By: Claude Fable 5.1 <[email protected]>
Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG

src/openultrasast/model/scan.py

@@ -397,6 +397,7 @@ def _evidence_pass(
             # the brief names it as the field to thread through next.
             access_declared_public=region.rank >= 1.0,
             bound_names=getattr(spec, "safe_shape_sinks", ()),
+            shipped=bool(getattr(region, "shipped", True)),
         )
         if evidence is not None:
             out[_pair_key(region, spec)] = evidence