Harden Paper staging and verification boundaries

[mrfloris]

Summary

• consolidate the manual staging, latest-build launcher, and bounded-retention branch stack
• require fresh exact Paper API authorization at staging and verification boundaries
• harden metadata-cache file handling and neutralize untrusted terminal controls
• make verify fail closed while preserving supported legacy and optional-state behavior
• document the security contract and retain the Security Objectives and Assumptions review in the todo list

Validation

• 108 Python unit tests
• shell syntax checks for paperscript.sh, 1MB-minecraft.sh, and tests/live-smoke.sh
• Python compilation checks
• git diff hygiene check
• live PaperMC smoke test against Paper 26.2 build 121