fix: prove managed runtime candidates are self-contained

[brxs]

What

• add gpu_broker.py and sa3_cuda.py to the embedded, sealed backend source closure and bind that closure digest into service provenance
• run isolated import smoke checks from the materialized candidate before sealing or promotion, with no source checkout on sys.path
• fail candidate validation when either new source module is missing, and retain the existing full inventory, target, generation, digest, symlink, and unexpected-file checks
• keep env_clear() at the launch boundary while adding only explicitly declared Windows essentials: SYSTEMROOT, WINDIR, TEMP, and TMP
• obtain the Windows directory from GetWindowsDirectoryW, and reject linked/reparse or escaping app-owned temp directories before injecting them
• prove service secrets remain exclusive and that PATH, home/profile values, credentials, Python path injection, and developer overrides remain absent

Why

Managed installs previously sealed most backend sources without the new GPU broker and SA3 CUDA policy modules. A candidate could therefore pass file validation but fail only when the promoted runtime imported a transitive module. Fully clearing the environment is the right launch boundary, but Windows children still need a small host-owned system/temp contract to start reliably.

Root cause

The sealed source list had drifted behind the runtime import graph, there was no import viability check against the materialized candidate, and the command verifier had no separately validated path for the minimal Windows process environment.

Impact

Incomplete candidates now fail before promotion. Managed Windows children receive exactly four OS/runtime values plus the service's declared paths and its own launch secret. This PR does not enable CUDA, alter sidecar/controller orchestration, change generation behavior, or modify release workflows.

Checks

• cargo test --locked --workspace --manifest-path src-tauri/Cargo.toml (301 app tests passed, 2 ignored; 116 engine tests passed)
• cargo test --locked --workspace --features managed-runtime --manifest-path src-tauri/Cargo.toml (298 app tests passed, 2 ignored; 116 engine tests passed)
• cargo clippy --locked --workspace --all-targets --manifest-path src-tauri/Cargo.toml -- -D warnings
• cargo clippy --locked --workspace --all-targets --features managed-runtime --manifest-path src-tauri/Cargo.toml -- -D warnings
• focused platform-path suite (11 passed), managed-runtime suite, and model source/import tests
• git diff --check

Native Windows CI remains the platform proof for the Win32 helper. A macOS cross-check resolved and compiled windows-sys, then stopped in the unrelated ring C build because a Windows C SDK is not installed on the macOS host.

[brxs]

Superseded by and fully consolidated into #131. The combined branch includes this lane's substantive changes, subsequent integration fixes, and exact-head cross-platform validation. Please continue review in #131.