Rust-owned bounded receipt disclosure and inert inspection

[bordumb]

Closes #104.

What changed

• adds a canonical, bounded Rust receipt-disclosure format and effect-free opaque/summary/full inspection
• verifies receipt signatures, identifiers, linkage, profile binding, and command/result commitments before projection
• exposes matching TypeScript and Python APIs backed by the same native semantics
• adds one Rust-generated differential/adversarial fixture consumed by both SDK test suites
• gives maintained profiles ownership of safe human-readable receipt summaries
• encrypts demo disclosures with AES-256-GCM under tenant and receipt-bound authenticated context
• authenticates operator and auditor views through Northstar OIDC authorization code + PKCE
• updates the hosted incident-response control room for public, operator, and auditor receipt views

Security boundary

Signed receipts remain commitment-only. Opaque inspection never loads disclosure ciphertext; summary inspection never returns exact material; full inspection returns exact verified evidence only after the application authorizes the viewer. Every inspection result is inert and cannot authorize or execute an effect.

Validation

• targeted Rust receipt tests and binding checks
• shared TypeScript/Python adversarial fixture suites
• strict Python typing, package contract, and public API snapshots
• architecture, binding-semantics, SDK-experience, fixture, and semantic-freeze gates
• full cross-company demo validation: service tests, integration, browser OIDC views and attack lab, and real Iroh transport test
• staged secret scan