fix: verify storage-first final release recovery

[mellowcroc]

Summary

• pin the corrected Proof-tool runtime and verify final release signing against the authenticated review checkpoint
• make fresh storage-first inspection keep an explicit artifact root and its children in one read-only Docker mount
• add live R2 final-state reconstruction and isolated S3 initial-state/grant-scope coverage
• retain immutable-write, credential-isolation, and frozen-workflow recovery protections

Validation

• go test ./... -count=1
• go vet ./...
• bash scripts/test-install-launcher.sh
• live R2 minimal-role ceremony through both phases, coordinator replay, final release checkpoint, and fresh-workspace reconstruction
• live S3 initial-state reconstruction and scoped temporary-grant test

Limit

A complete live S3 contribution-to-release rehearsal is still pending. Tessera-backed storage-first ceremonies remain disabled until the compatible setup-v3 grant/status contract is deployed; existing frozen ceremonies are unchanged.