refactor(core): remove typed governance schema, generalize metadata merge (Phase 2 of #1172)

[christso]

Summary

Phase 2 of #1172 — subtractive, no new code.

Removes the typed governance schema from packages/core/ (introduced in #1165) and generalises the suite-↔-case metadata merge. Governance data continues to travel through existing generic metadata: Record<string, unknown> on EvalTest and EvaluationResult.

Deleted from core:

• GovernanceMetadataSchema, GovernanceMetadata type, and governance field from EvalMetadata in metadata.ts
• KNOWN_GOVERNANCE_FIELDS, EU_AI_ACT_RISK_TIERS, validateGovernance, isWellFormedControlId, extractGovernanceBlock from eval-validator.ts
• Both validateGovernance(...) call sites (suite-level and case-level lint)
• -427 lines net, +37 lines (the generalised merge function)

Generalised:

• mergeCaseGovernance → mergeSuiteMetadataPayload: applies the same array-concat-dedup / scalar-case-wins rules to all keys under metadata, not just governance. No governance-specific branches remain.

Test updates:

• metadata.test.ts: removed governance-specific tests; added regression for "returns undefined when only governance is present and name is absent"
• yaml-parser-metadata.test.ts: removed suite-level suite.metadata?.governance test (governance no longer in EvalMetadata); case-level merge tests preserved and still pass
• eval-validator.test.ts: removed governance metadata validation describe block (6 tests)

Test plan

• bun test passes (all 1735 tests)
• JSONL metadata.governance output byte-identical to main — dry-run UAT:
  • main: { "governance": { "schema_version": "1.0", "owasp_llm_top_10_2025": ["LLM01"], "mitre_atlas": ["AML.T0051"], "controls": ["NIST-AI-RMF-1.0:MEASURE-2.7", "EU-AI-ACT-2024:Art.55"], "risk_tier": "high", "owner": "security-team" } }
  • branch: identical
• Pre-push hook passed: Build ✓ Typecheck ✓ Lint ✓ Test ✓ Validate eval YAML ✓

Closes #1172 (Phase 2)