Track the capture and replay tooling that the evidence files name (DEC21)

Seven scripts are named by `verification.md` files across
`outputs/feature-evidence/` as the way to reproduce a capture: capture-shot,
capture-from-file, capture-care-evidence, capture-evidence, dump-dom, d18-save
and d30-actions. All seven lived in `/work/`, which `.gitignore` excludes as a
scratch directory -- so the evidence told a reader to run files the repository
does not contain. Anyone cloning this could run the tests but could not replay a
single capture.

They are now in a tracked `scripts/`. `/work/` keeps its job: page lists, fault
injection, throwaway diagnostics and Chrome profiles stay there, untracked.

- 13 files that referenced them were updated to the new path (evidence reports
  and one captured command transcript)
- internal comments that named the old location now name the new one
- capture-from-file finds its sibling through `$PSScriptRoot`, so the pair still
  works after the move -- verified by running a capture from `scripts/` before
  committing
- capture-evidence derives the project root from its parent directory, which is
  the same depth in either location, and it still writes its scratch artefacts
  (chrome profiles, last-dom.html) into `/work/`

Decided by the user as DEC21 and recorded in
`outputs/BITMED-Decision-Register-v1.md`: evidence may not name a file the
repository does not contain.
