Harden validator wiring and derived-copy acceptance

[referencefield]

Development-only hardening; this does not start acceptance.

Changes:

• correct SETUP.md so derived copies accurately describe validator runs on every push to main
• mark the human-readable bootloader block and have tools/validate_protocol.py require it to match PROTOCOL.yaml exactly
• have tools/validate_protocol.py verify PROTOCOL.yaml's validation trigger contract matches the actual workflow, including pull_request and push-to-main
• extend Gate 3 so a private Use-this-template copy must prove the advisory validator launches from the exact durable-state main push and completes RESULT: PASS

Protocol remains unreleased/development.