feat(control-plane): preflight exact installed packages

[selmanays]

Summary

• add the Control Plane preflightBundlePackages public API for exact installed-package admission
• require one and only one package whose id, version, target, and recomputed SHA-256 digest match the authenticated Bundle authority
• authenticate the Web/React generated Catalog guard, preserve inert byte ownership, and reject loaders, callbacks, discovery locations, ranges, fallbacks, duplicates, and hostile containers
• publish deterministic M07-T03 evidence and advance current normative coverage, proof matrices, project status, and README progress to 77/145
• harden the historical M06-T11 isolated runtime probe with an explicit 20-second Vitest timeout while preserving its frozen evidence bytes and assertions

Proof

• M07-T03 artifact: docs/proof/artifacts/control-plane-api-0.1.0-package-preflight.json
• artifact SHA-256: 79ec5f2d285868ecd7e08b4649b160087810b08346d7741796c09d14749f4628
• installed distribution artifacts authenticated: 80
• focused Control Plane cases: 39/39
• compile-time negative cases: 9
• root mutation cases: 16/16
• proof-reader checkpoint head: 790ad28b6fd441e6d5f40f277a97e8de36a178a9e50fff3e208e6c27588915fd

Verification

• node scripts/ci/run-required-exhaustive-quality-gate.mjs
• result: PASS
• clean revision: c74e8718038e7493d85a480fa59c7f00e0caca20
• exhaustive workloads: 134/134
• proof pairs: 63/63
• dependency boundaries and boundary fixtures: PASS
• workspace before/after digest: unchanged

Scope

• M07 progress: 3/11
• overall plan progress: 77/145
• next task: M07-T04