feat: add derived-access qualification runner

[kevinswiber]

Summary

• add deterministic D0-128, L1, and L7 native smoke and lifecycle evidence modes
• add retained-root preflight/bootstrap plus APFS L100/C262 scale and resource measurement modes
• add raw-bound fragments, completion-last package assembly, and recursive verification that reconstruct every evaluator summary from typed receipts
• keep the runner bench-gated and leave authoritative loose event/content storage and production routes unchanged

Validation

• just check (3,056 passed, 2 declared skips)
• cargo +stable nextest run --locked --features "bench longitudinal-counting" --no-tests pass (3,062 passed, 2 declared skips)
• focused derived-access tests in default and counting builds
• adversarial forged-receipt, forged-fragment, direct-package, and manifest-repair probes
• just lint
• just fmt
• just derived-access-help
• just derived-access-contract
• just derived-access-smoke D0-128
• git diff --check

Boundaries

This adds qualification-only tooling. It does not select or activate a storage profile, migrate data, persist body/search material, or change release behavior.