test(evidence): harden generation lifecycle boundaries

harness/tht/vectorstore/rest_client.py

@@ -6,6 +6,7 @@ Errori in italiano e azionabili, stile `rest/client.py`.
 """
 
 import requests
+import re
 
 from tht.config import RestConfig
 
@@ -128,6 +129,8 @@ class VectorRestClient:
         return len(rows)
 
     def delete_generation(self, table_name: str, generation: str) -> int:
+        if table_name != "evidence" or re.fullmatch(r"gen:[0-9a-f]{32}", generation) is None:
+            raise ValueError("generation must be canonical")
         try:
             payload = self._call(
                 "delete_vector_generation",
@@ -155,4 +158,10 @@ class VectorRestClient:
                     "list_evidence_generations RPC is unavailable; deploy the cleanup migration"
                 ) from None
             raise
-        return sorted({row["generation"] for row in rows if isinstance(row, dict)})
+        if not isinstance(rows, list) or any(
+            not isinstance(row, dict)
+            or re.fullmatch(r"gen:[0-9a-f]{32}", str(row.get("generation", ""))) is None
+            for row in rows
+        ):
+            raise VectorRestError("list_evidence_generations returned malformed data")
+        return sorted({row["generation"] for row in rows})