Harden release validation and cache provenance

[farach]

Summary

• exercise every exported function through deterministic installed-package validation and add a public-API showcase contract for resurvey, content change, import adapters, measures, rollups, aggregation, and sensitivity movement
• require blocked-network installed-package tests, two-round clean-install validation, and pull-request pkgdown checks while preserving main deployment
• add atomic cache writes, actionable corrupt-cache failures, verified SHA-256 receipts, provenance metadata, cache locking, and source-receipt rollback
• fail closed when receiptless or explicitly unverified legacy cache bytes are asked to satisfy URL, version, as_of, or digest constraints; compare credential-safe URL fingerprints and require force = TRUE replacement
• correct sensitivity documentation and tests, synchronize development metadata, and add release-hardening regression coverage

Validation

• devtools::document()
• devtools::test(): 726 passed
• blocked-network built/installed package tests: 719 passed, 6 CRAN-only skips
• R CMD check --as-cran: 0 errors, 0 warnings, 1 expected note for the development/new-submission version
• Rscript tools/validate-clean-install.R --rounds=2
• external clean install and public API smoke validation
• pkgdown::check_pkgdown() and full pkgdown::build_site(preview = FALSE)
• workflow YAML parsing and URL checks
• GitHub checks: Linux, macOS, Windows, blocked-network installed tests, two-round clean install, and pkgdown all passed

Release-only notes

• CRAN still reports the expected new-submission/development-version note for 0.5.0.9000.
• Optional spelling, goodpractice, air, and aspell checks were unavailable in the local toolchain. No release, tag, or submission is included here.