release: add executable alpha evidence finalizer - #320

Refs #31.

Adds the current 0.1.0-alpha evidence contract and a RED-first executable validator contract without changing app/runtime/version/R8/signing behavior.

Current policy normalization:

• canonical persistent AVDs remain exactly API26 + API36;
• obsolete virtual.mainstream is rejected rather than reintroduced;
• virtual.low_ram is constrained runtime/device configuration on a canonical device, not a third AVD;
• every canonical gate remains explicit, including availability-conditional Fire TV;
• claim eligibility requires exact-commit gate/artifact provenance and APK/AAB SHA-256;
• secret/private-path metadata fails closed without echoing rejected values.

RED head: ea2cd6d3fd9621afca2c6d043562cf8df1a3e063.
tools/verify-local.ps1 now invokes tools/release/Test-AlphaEvidenceValidator.ps1; the production Validate-AlphaEvidenceManifest.ps1 is intentionally absent at this checkpoint. Expected RED is the missing validator entry point after repository/setup contracts pass.

This PR does not mark any #31 release gate PASSED and does not claim alpha readiness.