feat: add bounded Fable review transport

[BaseInfinity]

Summary

• add a candidate-bound Fable High reviewer backed by verified Claude subscription authentication
• isolate the reviewer with one turn, no tools/MCP/session persistence, and a wall-clock timeout
• ship and selectively update the reviewer across shell, PowerShell, setup, manifest, documentation, and skill surfaces
• add proof verification plus regression coverage for authentication, isolation, candidate binding, stale proof, update preservation, structured Claude envelopes, and Windows launch construction

Verification

• node scripts/run-proof-suite.cjs — 11/11 proof groups passed
• exact-diff self-review — clean
• independent Sol High review — no blocking findings
• Fable High review — CERTIFIED
• real Claude CLI 2.1.221 structured-envelope probe and final certification completed

Follow-ups

Non-blocking transport hardening remains outside this bounded change. #111 tracks enforcement of final approval against the exact integrated candidate, and #79 tracks real Windows Desktop/CLI validation.

Closes #64