fix: distinguish generated artifacts from AI disclosure

[VrtxOmega]

Summary

• stop treating generic generated-artifact wording as an AI/tool-authorship disclosure
• reuse the existing meaningful tool-generation pattern for accountability and provenance
• preserve explicit unverified tool-generation failures with a positive control

Root cause

SIGNALS.aiDisclosure included the standalone word generated, while
hasMeaningfulToolGeneration() already required explicit model or tool
provenance. That mismatch could fail contributor accountability for ordinary
repository language such as generated README.

The patch gives both paths the same explicit disclosure pattern. It does not
change the separate generated/bundled/vendor artifact review gate.

Verification

• node --test --test-name-pattern='generated artifact wording|explicit tool generation' test/evaluator.test.mjs — 2/2 passed
• npm run check — passed
• npm test — 276/276 passed
• npm run benchmark — 77/77 passed
• npm run redtest — 29/29 passed, including generated-bundle-pr
• git diff --check — passed

Assurance boundary

PCF rated the exact patch ready-for-maintainer at 100/100 with a 16-minute
review budget. VERITAS passed the structural, math, cost, security, and trace
gates, while correctly remaining INCONCLUSIVE for independent assurance
because the verification is author-side.

Assistance disclosure

OpenAI Codex helped isolate the false positive, prepare the minimal patch, and
run the checks. I reviewed the exact diff and verification output before
submission.