Add Phase 4 community validation packet

[nccrypto]

Problem

Phase 4 requires upstream review and at least three external test users, but the project did not have a reproducible, privacy-bounded way to collect public validation evidence.

Changes

• add a network-free community validation harness covering pass, finding, retry-exhaustion, and local execution-boundary paths
• add a strict community-validation result schema and deterministic synthetic example
• add an external tester protocol and feedback template with explicit sensitive-data review and sharing consent
• add unsent Reppo and Virtuals technical-review drafts
• document the evidence gate for a bounded 60-day sponsorship request
• update public documentation, example, schema, and changelog indexes

No Phase 4 adoption, review, contribution, or sponsorship roadmap item is marked complete by this PR.

Public sources and boundary

This change uses only existing public project artifacts, public upstream links already documented by the toolkit, and synthetic fixtures. The harness performs no network request, inference, wallet operation, signing, payment, settlement, upload, or GitHub mutation. Generated sharing flags default to false.

Verification

PYTHONDONTWRITEBYTECODE=1 PYTHONPATH=src python3.11 -B -m unittest discover -s tests -q
# Ran 94 tests — OK

python3 scripts/check_public_boundary.py .
# passed

git diff --check
# passed

python3 -m compileall -q src scripts tests
# passed

Additional verification:

• live harness output validated against the new JSON Schema
• committed example regenerated byte-for-byte
• source distribution and wheel built with --no-isolation outside the repository
• package contents inspected for the new schema, docs, examples, script, and tests
• final tree audited for generated archives and private-shaped content

Risk

Low. The change is additive, offline, synthetic, and does not expose a live ACP or transaction interface.

Compatibility and rollback

Existing runtime and schemas are unchanged. Rollback is a normal revert of this additive commit; no external state or migration is involved.