Part of #1486.

Foundation — blocks the rest of the epic. Pure refactor, no output change.

Introduce a single source of truth in pkg/header:

const Domain = "aicr.nvidia.com" // single knob; flipped to aicr.run in a later issue
const APIGroup = Domain

Route every scattered aicr.nvidia.com literal through it (currently ~470 occurrences across the tree, only the artifact apiVersion group is centralized today):

• pkg/header — APIGroup derives from Domain
• pkg/validator/labels/labels.go — label keys → Domain + "/job-type" etc.
• pkg/bundler/bundler.go, pkg/cli/validate.go — annotation keys
• pkg/evidence/attestation/types.go, pkg/bundler/attestation/statement.go, pkg/bundler/deployer/localformat/provenance.go — attestation/provenance/buildType URIs and the UUIDv5 namespace seed
• pkg/build/spec.go — ExpectedAPIVersion

Acceptance criteria

• No behavioral/byte change — value stays aicr.nvidia.com; all goldens/fixtures unchanged
• grep -rI 'aicr\.nvidia\.com' --include=*.go (excluding pkg/header definition + godoc examples) returns no hard-coded literals
• make qualify green