Add HO-DET-012 runtime receipt verifier

[raylee-hawkins]

Adds deterministic verifier/schema/redacted sample for private HO-DET-012 runtime receipt.

• Verifies private Wazuh-backed scheduled-task runtime receipt without exposing raw evidence.
• Splunk remains NOT_VERIFIED.
• No public runtime proof is promoted.

Validation run locally:

• validate-ho-det-012.py
• verify-ho-det-012-result-parity.py
• scan-ho-det-012-claim-boundaries.py
• verify-ho-det-012-runtime-receipt.py --receipt
• git diff --check

[raylee-hawkins]

Reviewed HO-DET-012 runtime receipt verifier PR. Scope is validation verifier/schema/redacted sample only. Private runtime receipt exists under Data and is not committed. Wazuh observation is private/hash-backed; Splunk remains NOT_VERIFIED. This PR does not promote public runtime proof, public signal proof, production readiness, autonomous SOC, AI disposition, or analyst disposition.