Add proof and consumable outputs through S30

[Valessc2]

Scope

Completes S28-S30 while keeping proof/output machinery physically outside the runtime dependency graph.

S28 — deep tests

• deterministic property/fuzz-style geometry invariants
• filtering equivalence against an independent reference predicate
• spatial-grid exact InputOrder equivalence against brute force across generated worlds/cell sizes/radii/boundaries
• unordered spatial membership equivalence
• non-finite fail-closed regression coverage
• fixed seed for reproducible failures

S29 — benchmark/workload profiles

• explicit hardware/workload profile contracts
• synthetic vs representative workload kind is part of identity
• deterministic synthetic spatial profile committed under Profiles/
• representative workload template requires real corpus identity/hash before it can become evidence
• spatial benchmark upgraded from a single median to p50/p95/p99 over 31 samples and emits profile/seed identity

S30 — consumable outputs

• separate sc2opt_proof library; not linked by sc2opt::sc2opt
• standard-library JSON certification manifest writer
• v1 JSON schema under schemas/
• benchmark records include samples, mean, p50/p95/p99 and correctness status
• proof layers are monotonic: source/design -> build/tests -> representative benchmark -> consumer integration -> ladder/runtime
• synthetic workloads cannot claim representative benchmark proof

Why

This gives BotOps and future consumers machine-readable evidence without allowing CI success or synthetic timings to masquerade as stronger runtime certification.

Validation gate

Full Linux/Windows core and Python-adapter CI on this PR is the implementation/build/test gate. CI timing itself remains synthetic and is explicitly not target-hardware certification.

Not claimed

No representative consumer corpus, target-hardware crossover, bot integration, ladder evidence or V1 certification is claimed by this PR. S31-S32 and real consumer evidence remain outstanding.