Run adversarial campaigns from workspace recipes

[chubes4]

Summary

• add additive adversarial campaign declarations to workspace recipes with typed matrices, budgets, mutators, oracles, faults, checkpoints, and capability requirements
• execute generated cases through the existing fuzz-suite/runtime episode path and persist bounded sealed evidence with deterministic replay
• expose CLI campaign run/replay commands while preserving existing static fuzzRun.cases behavior
• fail closed before side effects when required capabilities or declared fault adapters are unavailable

Verification

• build and adversarial/runtime/command/schema/fuzz/service/public API suites passed
• live Playground recipe completed eight deterministic stateful cases through checkpoint-backed workloads and destroyed the runtime cleanly
• release package coverage and npm pack --dry-run passed
• same-seed replay, fingerprints, minimization, cancellation, teardown, bounded evidence, and backward compatibility are covered
• repository-wide npm run check reaches only the unchanged pre-existing command-registry-smoke fails on main: wordpress.collect-workload-result outputShape missing outputSchema id mention #1745 command-registry assertion

Closes #2019