Use the canonical current and supported legacy process-provider rule for authenticated capture Evidence at both CLI and MCP admission boundaries. Preserve successful Evidence and distinguish provider input errors from digest authentication failures. Closes #1757.