[kgofron]

Summary

• Add a deterministic dependency/version evidence generator with JSON and Markdown output.
• Record:
  • the ADTimePix3 version and exact commit;
  • the pinned ci-scripts commit;
  • EPICS Base, asyn, and ADCore selected refs, versions, repositories, and exact commits;
  • bundled CPR and nlohmann/json versions and evidence-file digests;
  • the ADCore CI configuration-hook digest.
• Verify that each declared dependency ref matches the branch or exact tag actually checked out.
• Remove credentials from repository URLs and omit timestamps and local filesystem paths.
• Retain the generated report as the dependency-versions-base-7.0 workflow artifact.
• Add fixture-based tests and contributor/release documentation.

This is build and release-assurance work only. No PV names, IOC databases, NDArray addresses, driver behavior, or Phoebus screens are changed.

Validation

Local validation passed:

• 3/3 dependency-report tests;
• deterministic report reproduction with byte-identical JSON and Markdown output;
• credential and local-path exclusion checks;
• 346/346 deterministic C++ tests;
• 11 implemented coordinate-map cases; five planned physical SpIDR 2×4 cases remain deferred;
• 47/47 Phoebus BOB files parsed as XML;
• REUSE validation for 380/380 files;
• workflow YAML and three-entry matrix validation;
• git diff --check.

Hosted CI should confirm the default, AddressSanitizer, and UndefinedBehaviorSanitizer jobs and publish the new dependency evidence artifact.