feat: provider-cache bypass knob; reject non-final comparator chain steps

- check() gains cacheProviderResults (per-check option + policy default): the
  provider cache is a STORE-RETRIEVAL cache (wall-clock), independent of the
  caller's decision { now }; callers who pin time or want fresh retrieval can
  opt out per-check or globally.
- The generator now rejects a comparator evidence referenced at a NON-final
  chain position (a comparator compares values at (src, candidate) but
  provides no candidate set, so it cannot enumerate intermediate nodes).
  Final-position comparators still lower to condition steps.

Tests: cache bypass (per-check + policy), comparator final OK / intermediate
error.

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arbiter/evidence-dsl",
-  "version": "1.8.0",
+  "version": "1.9.0",
   "description": "Evidence DSL v2 compiler: translates the natural Evidence DSL (ADR-000) into @arbiter/core relation configurations.",
   "license": "ISC",
   "type": "module",