fix(proof): make the offline Isabelle sandbox portable on Ubuntu

[doublewhy]

Requirement: ASR-535

Observed on a clean Ubuntu 24.04 x86_64 GCE verifier using the repository-pinned Isabelle2025-2 archive and bubblewrap 0.9.0. After bubblewrap network isolation was established, tools.isabelle_tool verify failed before theorem replay with: Fontconfig head is null, check your fonts or fonts configuration.

Root cause: the sandbox binds /etc/fonts and /usr/share/fonts but creates an otherwise empty /usr/share. Ubuntu fontconfig files under /etc/fonts/conf.d point into /usr/share/fontconfig, which is not in ISABELLE_SYSTEM_RUNTIME_PATHS. The declared allowlist is therefore incomplete and the canonical proof lane is host-image dependent.

Acceptance:

• Bind the minimum fixed fontconfig data path needed by the pinned prover, without binding host root, user home, or enabling network.
• Validate allowlist construction with focused line and branch coverage.
• Replay the pinned proof successfully on Ubuntu 24.04 x86_64 with bubblewrap network isolation.
• Preserve checksum verification, fixed argv/environment, bounded resources, and evidence digest behavior.
• Document the operational portability boundary and exact verification evidence.

This is core OpenRAE proof-gate reliability; it does not change theorem semantics or experiment code.

[doublewhy]

Implemented locally (not pushed) in f8023174 and 8a04cee1. Focused Python tests: 22 passed; changed tools/isabelle_tool.py lines and branches: 100%; Ruff and repository policy: pass; requirement governance attempted but the configured Ground Control host was unavailable. Real Ubuntu 24.04 x86_64 replay used the checksum-pinned Isabelle2025-2 archive under bubblewrap network isolation and returned kernel-checked for Participant_Opacity with unchanged result digest sha256:6ad5778c78667a992cca5b958ebc0764f8880115de4ac2f99f22ec6883400325. The complete tools.check_participant_opacity_proof validator then reported participant-opacity-proof: verified. The branch is clean and unpushed.

[doublewhy]

Follow-up 61643f99 now distinguishes host sandbox setup from theorem rejection. On the same Ubuntu 24.04 verifier, the normal unprivileged command fails closed with the exact stable diagnostic bubblewrap network isolation is unavailable for offline proof replay under the host AppArmor restriction; it does not retry without isolation. An isolated privileged replay still completes the full repository proof validator as participant-opacity-proof: verified with the unchanged kernel result digest. Focused total is now 23 tests, and all newly changed tool lines/branches remain 100% covered.