Serve the sealed evidence bundle behind a timeline element's provenance link.

bundle_hash is recomputed from the canonical binding bytes on every read, so the drawer always shows the bundle's current identity -- and a bundle that no longer matches the hash a phase receipt bound projects that phase as unverified in the mission projection above.