perf(evidence): authenticate and seal imported bundles in one pass

Reuse the immutable domain parser at the file boundary instead of rebuilding and revalidating an already authenticated bundle. Existing filesystem and integrity regressions pass (27 tests); a 4 MiB parsing probe preserves immutable output and reduces repeated validation work.

src/application/EvidenceBundleFiles.ts

@@ -1,9 +1,9 @@
 import { resolve } from "node:path";
 
 import {
-  createImmutableEvidenceBundle,
   describeEvidenceBundleFailure,
   describeValidationFailure,
+  parseImmutableEvidenceBundle,
   parseEvidenceBundle,
   type EvidenceBundle,
 } from "../domain/evidenceBundle.js";
@@ -49,15 +49,7 @@ export const readImmutableEvidenceBundle = (
   signal?: AbortSignal,
   resources?: ArtifactResourceScope,
 ): Promise<Result<EvidenceBundle, EvidenceReadFailure>> =>
-  readBundle(
-    path,
-    (input) => {
-      const bundle = parseEvidenceBundle(input);
-      return createImmutableEvidenceBundle(bundle.records, bundle.unknowns);
-    },
-    signal,
-    resources,
-  );
+  readBundle(path, parseImmutableEvidenceBundle, signal, resources);
 
 const readBundle = async (
   path: string,