Finish hardening and V1 contract through S32

[Valessc2]

Scope

Completes the final software slices S31-S32 while preserving the distinction between 32/32 implemented and externally certified V1.

S31 — toolchain hardening

• explicit ASAN/UBSAN gates with fail-closed compiler support
• optional LTO/IPO capability gate
• explicit AVX2 hardware-contract switch, default OFF
• mutually-exclusive PGO generate/use modes with MSVC and GNU support
• clang-tidy analyzer gate
• proof-only p95/p99 performance-regression checker with identity/evidence validation
• broader CI: sanitizers, static analysis, installed-consumer packaging and AVX2 compile-only gate

S32 — V1 contract and integration boundary

• public API contract 1.0 with status v1-candidate
• install/export CMake package under sc2opt::
• unrelated installed C++ consumer proof using find_package(SC2AIOptimize CONFIG REQUIRED)
• certification manifests now carry/validate API contract identity
• versioned BotOps machine-readable handshake under integrations/botops/
• explicit API compatibility/versioning policy
• explicit V1 implementation-vs-certification document

Runtime cost discipline

The runtime umbrella remains sc2opt::sc2opt and does not transitively link the proof library. Sanitizers, static analysis, profiling, PGO training, manifests and regression checks are build/proof machinery, not mandatory ladder-runtime work.

No ISA-specific or PGO mode is enabled by default. Requested unsupported modes fail closed rather than silently degrading or pretending to be enabled.

Expanded CI gate

This PR must pass:

• Ubuntu + Windows core Release build/tests
• Ubuntu + Windows Python adapter build/tests
• Ubuntu ASAN+UBSAN full tests
• clang-tidy analyzer build
• Ubuntu + Windows installed-package unrelated consumer with LTO
• explicit AVX2 compile gate

Certification status

If this PR passes and lands, the 32-slice software programme is 32/32 implemented. It does not mean V1 runtime certification is complete.

The API remains v1-candidate until real evidence closes the external gates: representative target-hardware benchmark/crossover evidence, real C++ and Python bot/framework integration, behavioural/equivalence evidence where replacing logic, ladder/runtime proof, and BotOps release acceptance.