feat(cuda): add non-certifying real-NVIDIA E3 evidence

[rextio]

Summary

Adds an opt-in, manual first-stage evidence path for the bounded TensorFlow CUDA E3 candidate while preserving the existing non-certifying contract.

• Adds a Linux x86_64 GNU / CPython 3.11 / TensorFlow 2.21.0 / Rust 1.93.1 real-NVIDIA harness.
• Requires exact clean Core and CUDA-provider commits plus an explicit full plugin commit descended from the integrated E3 base.
• Runs the real CUDA driver probe, provider authorization, Core analysis/codegen, pinned Cargo lock generation, and a locked native-extension build.
• Installs and loads the exact generated _rextio_native extension in the same process as the active TensorFlow wheel.
• Exercises the frozen matmul -> bias_add -> relu -> reduce_mean(axis=1) GPU:0 slice, numerical parity, input immutability, output lifetime, repeated calls, and the five implemented negative boundaries.
• Captures exact generated artifacts and mapped TensorFlow wheel DSOs, including hashes, sizes, and ELF build IDs.
• Adds a canonical, closed-schema offline verifier with bounded input handling.
• Adds GPU-free CI contracts, documentation, changelog, and sdist coverage for both scripts and their focused tests.

Evidence semantics

This does not promote CUDA support or certification:

• support_claim=false
• certification_ready=false
• kernel_activity_verified=false
• runtime_transfer_profiled=false

The evidence is self-attested by the manual harness. The offline verifier checks canonical schema and payload integrity only; it does not authenticate the producer, recompute artifacts, prove execution, certify hardware, or establish performance.

Hosted CI remains GPU-free. It does not install/import TensorFlow in the CUDA evidence lane, load the extension, or execute CUDA. A real-NVIDIA run remains an explicit later operator action.

Review hardening included

• Generates Cargo.lock with the pinned toolchain before the required --locked build.
• Binds PyO3 to the active CPython and installs the extension with the exact EXT_SUFFIX.
• Evicts stale generated modules and verifies both wrapper and native-extension provenance.
• Loads the build helper and verifier only from the attested plugin checkout, after checkout validation.
• Recomputes provider profile and preflight hashes and binds authorization, lock, observations, and probe identity.
• Requires exclusive destinations outside all attested checkouts and rechecks source identities before evidence creation.
• Uses exact parsed /proc/self/maps paths for the three TensorFlow DSOs and rejects deleted/suffixed aliases.
• Enforces canonical JSON, closed fields, bounded reads/depth failures, and controlled malformed-input errors.

Local verification

• pytest -m 'not needs_cargo': 408 passed, 1 skipped
• Focused harness/verifier tests: 48 passed
• Ruff: passed
• mypy for package and both scripts: passed
• compileall and git diff --check: passed
• Workflow YAML parse: passed
• Direct/module CLI help and TensorFlow-free imports: passed
• Fresh wheel + sdist build: passed
• Twine, check-wheel-contents, and exact sdist byte contract: passed

No real GPU success is claimed by this PR.