Add generation-bound retrieval projections

[jeremydixon22]

Summary

• add an optional immutable generation-bound retrieval contract, local reference implementation, durable generation builder composition, and exact-generation OpenSearch implementation
• add language-neutral descriptor/lifecycle conformance plus Python execution of the shared fixtures
• add consumer-neutral Cloudflare Worker/R2 direct and isolated service-reader topologies with a deterministic proof harness
• publish component-bound retrieval qualification while keeping consumer-validation evidence opaque
• update the README and supporting documentation for the new capability and its limits

Verification

• scripts/run-dotnet-tests.sh Vyral.sln
• scripts/verify-python-runtime.sh
• python3 scripts/verify-worker-r2-generation-projection.py --output /tmp/vyral-worker-r2-proof.json
• python3 scripts/verify-retrieval-projection-qualification.py qualification/retrieval-projection-qualification.json --source-root . --public-disclosure
• scripts/verify-public-export.sh --allow-dirty