feat: add secure-runtime snapshot comparator

[shaggitza]

Summary

• add a schema-v1 comparator for paired secure-AST and isolated-runtime list/impact snapshots
• validate exact configuration, provenance, inventory, impact, telemetry, resource, image, lock, SBOM, and snapshot bindings before comparison
• separate operational outcomes from the paired-success quality subset and preserve runtime as a positive-observation comparator—not truth
• require source adjudication for every disagreement and retain canonical provenance digests

Scope and closed gates

This is the comparator foundation for #100. It does not implement or authorize a real artifact producer, execute a corpus, run a trusted runtime, or publish canonical results.

The producer gate and trusted gVisor/Kata canary gate remain CLOSED. Snapshot-specific pinned images/SBOMs and trusted list/analyze canaries are still required before any execution or publication.

Validation

• 35 comparator tests passed
• 42 evaluator and 20 runner telemetry regressions passed
• Ruff, strict focused mypy, and whitespace checks passed
• terminal comparator review: PASS
• post-rebase review on merged P0: Make accuracy benchmarks fail closed and measure real incremental latency #283 telemetry: PASS

Advances #100