refactor: derive the release identity from the package name

The supply-chain builder id and the two verifier ids each hardcoded the
repository name, in three source files plus a copy in the test fixture.
A project derived from this template had to edit all four, and all four
then became permanent conflict points for every merge back from here.

They now read the `name` this repository already declares in
package.json, so deriving a project is one line. The name is read once
at module load from a URL relative to the module itself, not from the
working directory, because these ids end up in signed provenance and
must not depend on where a script was invoked from. A missing or empty
name throws rather than falling back, for the same reason.

The value is hosted in scripts/lib/supply-chain.ts because all three
consumers already import it and it is already registered in
LOCAL_EVIDENCE_VERIFIER_SOURCE_PATHS. A new module would have needed to
join that list, which is itself part of the evidence surface.

This repository's own name is unchanged, so every emitted id is
byte-identical to before.

Also registers the three adapter files that 5cc4146 added without
updating the inventory ledger, which had left check:adapter-inventory
failing on develop.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tests/unit/security-followup-fixture.ts

@@ -11,9 +11,11 @@ import path from "node:path";
 import { localEvidenceAssessmentArtifactSchema } from "../../scripts/contracts/release-artifacts.ts";
 import { PROMOTED_FILE_NAMES } from "../../scripts/contracts/promotion-artifacts.ts";
 import {
+  PROMOTION_VERIFIER_ID,
   providerEvidenceSignaturePayload,
   trustPolicySha256,
 } from "../../scripts/lib/provider-evidence.ts";
+import { LOCAL_EVIDENCE_VERIFIER_ID } from "../../scripts/lib/local-release-evidence.ts";
 import {
   LOCAL_EVIDENCE_ASSESSMENT_PATH,
   distSha256,
@@ -35,7 +37,7 @@ export function passingAssessment(): any {
     generatedAt: "2026-08-02T00:00:00.000Z",
     status: "PASS" as const,
     verifier: {
-      id: "clean-architecture-frontend-template/local-evidence-verifier",
+      id: LOCAL_EVIDENCE_VERIFIER_ID,
       version: "1",
       sourceSha256: digest("verifier source"),
     },
@@ -180,7 +182,7 @@ export function syntheticSignedPromotionBundle() {
     verifiedAt: "2026-08-02T01:00:00.000Z",
     status: "PASS",
     verifier: {
-      id: "clean-architecture-frontend-template/promotion-verifier",
+      id: PROMOTION_VERIFIER_ID,
       version: "3",
     },
     run,
@@ -496,7 +498,7 @@ export async function createArchivedAssessmentFixture(): Promise<{
   const assessment = localEvidenceAssessmentArtifactSchema.parse({
     ...passingAssessment(),
     verifier: {
-      id: "clean-architecture-frontend-template/local-evidence-verifier",
+      id: LOCAL_EVIDENCE_VERIFIER_ID,
       version: "1",
       sourceSha256: supplyChainDigest(
         policyInputs.filter(({ path: policyPath }) => verifierPaths.has(policyPath)),