ci: add verified module matrix

[Artexis10]

Summary

• add revision-bound validation sidecars and deterministic synthetic scenarios for the production module catalog
• run the compiled Windows engine through capture, rebuild, verify, revert, recovery, and convergence across eight balanced shards
• resolve every tracked catalog bundle twice, retain a Notepad++ engine-contract canary, and aggregate compact fail-closed evidence under the stable Verified Module Matrix check
• harden production capture/restore selection and validation behavior exposed by real compiled-engine journeys

Why

Existing mocked and unit coverage could not prove that the shipped engine, checked-in module definitions, settings restore, and validation evidence execute together. This change turns module compatibility into visible, repeatable CI evidence.

Coverage

• 359 production modules
• 362 synthetic scenarios
• 8 Windows synthetic shards
• all tracked bundles resolved twice
• Windows integration, Go test/vet on Windows/macOS/Linux, and a dedicated Notepad++ canary

Proof boundary

This proves compiled-engine behavior plus checked-in module mechanics inside a disposable synthetic sandbox. It does not claim installed-app/live-host compatibility or GUI end-to-end coverage; those remain explicit follow-up layers.

Local verification

• OpenSpec strict: 95/95
• focused vet/tests and production sidecar metadata: pass
• fresh compiled-engine journeys: Stream Deck, Wave Link, Dolphin, Clink, Winamp, and mGBA pass
• independent code review: approved
• origin/main is an ancestor; worktree clean at cbf680a

Notable real defects found and fixed while exercising the compiled path include explicit --only module retention, capture/restore glob parity, nested verifier preservation, optional capture isolation, fixture topology overlap, and module declaration issues in Clink, Dolphin, Winamp, Wave Link, and mGBA.