* feat(extensions): add request-scoped run evidence reader * fix(extensions): reject padded evidence reader identities