Function resolveTimestampEvidence

Resolve timestamp assurance evidence for an audit event.

Decision logic: disabled/local_only → local ntp_check → NTP-validated tsa_critical + critical → TSA stamp tsa_critical + non-critical → NTP-validated

TSA failures result in tsa_failed evidence (never silent).