feat: add legacy Matrix V2 compatibility profile

[MarcoPorcellato]

Summary

• add the derived matrix-v2-legacy-v1 compatibility profile needed to reproduce the trusted historical Matrix V2 digests without hard-coding expected output;
• retain current admission and terminal-cleanup behavior while binding legacy plan, policy, runtime, and receipt provenance;
• make the two Matrix fixture tests use the reviewed writable CCP_TEST_ROOT binding under a read-only repository mount.

Exact evidence

• head: faf587890e4f899803f027660bc66452623f405e
• tree: 4615028176f3d594fbce0554f5e5edecfb802af1
• candidate SHA-256: 7cde4c2888721d72fbb8c86b4fdcc75f992050979c5175a5bf10b0cecfa7c6f8
• plan digest: bc348df299ee58ecc8f7cfc7f2dc743b5c03f1a90f7e5dbff45754017955e901
• receipt ID: sha256:65ff7b62fa949b549c87c1d599e76d67ebfa3edb3cc15d0cfae3972fdde236d9
• receipt raw SHA-256: 12f6d8988be5dc119eaa469cd3617a0f74e3416f7f66b5155d6cf3e1c1219670
• public evidence: ccp-evidence/faf587890e4f899803f027660bc66452623f405e:.ccp/receipt.json

The single generation-1 qualification passed formatting, all-target/all-feature tests, strict Clippy, documentation, and release-metadata checks. Candidate and installed-stable verification both returned PASS for the same receipt.

Review boundary

This PR is intentionally draft. It is 32 commits ahead of public main and overlaps parts of the still-open PR #64, so it must not be made ready or merged until that interaction is reconciled. The qualified candidate is not installed by this PR.