feat: add read-only runtime artifact evidence gate

[Pigbibi]

Summary

• generate one controller-owned registry for every required runtime snapshot
• verify GCS readability, manifest profile, SHA-256 and cadence-derived freshness with a read-only workflow
• keep failures parked and issue-only; no publication, runtime mutation or order path
• update coverage documentation and generated control-console assets

Verification

• python3 -m unittest discover -s python/tests -v (257 passed)
• python3 python/scripts/build_config.py --check
• python3 python/scripts/runtime_settings.py validate
• node --experimental-default-type=module tests/strategy_switch_worker_validation.mjs
• real read-only verification passed for all three currently required GCS artifacts