feat: add bounded provider evidence collectors

[minglong51]

Summary

• add a shared Python 3.10 standard-library engine for bounded private provider captures
• add fixed Claude, Codex, and Kimi entrypoints with executable staging and version/hash receipts
• cover caps, timeouts, descendants, signals, filesystem races, and atomic receipt publication
• run the synthetic provider-evidence suite on macOS and Linux CI

Verification

• 46 provider-evidence tests passed
• 35 profile tests passed
• 14 release tests passed
• 24 provider-evidence cells passed
• hub PTY smoke passed
• exact-patch Product, Engineering, Founder, and independent adversarial reviews passed

Boundary

No live provider/model requests were made and this PR makes no support claim. Live capture normalization and qualification remain separately gated for T9.