Add storage-first ceremony workflow and setup v3 policy

[mellowcroc]

Summary

• connect the normal coordinator, participant, and required release-signer journeys to authenticated storage state
• add signed immutable checkpoints, rollback/fork detection, exact upload attempts, conditional current-state updates, and crash-safe journals
• require coordinator mathematical replay before release; the release signer verifies and signs the exact reviewed package without mandatory independent replay
• add setup v3 with configurable beacon lead and explicit optional-assurance minima while preserving all frozen setup-v2/setup-v2r2 ceremonies
• pin the released Proof-tool commit 0a6ec7f39527df06b1aebf8c1a60ff3a75759e89

Validation

• go test ./...
• go vet ./...
• bash scripts/test-install-launcher.sh
• Relay CI: platform launchers, tests/unsigned rehearsal, and full ceremony/archive replay passed on the prior code commit; the final commit changes only release pins and notes
• Proof-tool release assets and GitHub provenance verified against the exact protected-main commit
• live R2 minimal-role rehearsal: enrollments and all of Phase 1 passed; current run entered Phase 2
• a prior live R2 run reached coordinator replay and final-candidate creation, then exceeded the 30-minute harness timeout during publication

Known limits

• no terminal live R2 final-release reconstruction was recorded before the merge decision
• complete live S3 validation remains pending
• storage-first witness, mirror, and auditor journeys are deferred; this release refuses enabled nonzero requirements rather than starting an unfinishable ceremony
• live validation uses the tiny rehearsal circuit, not production K=21
• storage-first Tessera ceremonies remain disabled pending the compatible setup-v3/attempt-bound contract; existing Tessera ceremonies retain their pinned releases

Compatibility

Existing setup-v2/setup-v2r2 ceremonies and the narrow frozen-release publication-recovery bridge retain their behavior.