feat(cyberbattlesim): implement RAES runtime backend

[Brad-Edwards]

Summary

Implements the maintainer-admitted CyberBattleSim chain profile as a RAES runtime target, preserving portable contracts, evidence, lifecycle controls, and explicit stochastic limitations without treating qualification gaps as an admission veto.

Requirement UIDs

• (none — bug/refactor/maintenance run; see Traceability section below)

Related Issues

Closes #27

ADR Impact

• ADR-002
• ADR-003
• ADR-021
• ADR-069

Changes

• Add dependency-light CyberBattleSim provisioner, orchestrator, participant runtime, evaluator, cleanup, manifest, target, and private serialized driver components.
• Run the checked-in chain scenario through the canonical RAES control plane with one native transition per admitted action, evaluator-owned evidence, reusable cleanup, and no native-state leakage.
• Bind run evidence to scoped execution identities and attest complete qualified simulator, Gymnasium, and NumPy import roots before driver import.
• Align CyberBattleSim and CybORG qualification records, mapping documents, and issue language so limitations bound reproducibility and installability claims rather than backend admission.
• Add contract-level, qualification, negative-boundary, lifecycle-reuse, artifact-tamper, and canonical conformance coverage.

Test Plan

• Unit tests pass
• Integration tests pass if applicable
• Configured completion command passes
• No coverage regression

Canonical make verify and make policy passed before publication and again on the synchronized merge tree. The conflict-resolution seam additionally passed 72 focused CybORG and CyberBattleSim tests. The pre-push test-quality review was clean.

Ground Control Checks

• Configured repository policy command passes
• gc_evaluate_quality_gates passes or is unchanged by this repo-only change
• gc_run_sweep reviewed; findings fixed or recorded with rationale

Traceability

• IMPLEMENTS: feat(cyberbattlesim): implement the conformant simulator backend target #27 ← src/raes_adapters/cyberbattlesim/backend/, feat(cyberbattlesim): implement the conformant simulator backend target #27 ← src/raes_adapters/cyberbattlesim/qualification.json, feat(cyberbattlesim): implement the conformant simulator backend target #27 ← docs/decisions/cyberbattlesim-backend-guardrails.md
• TESTS: feat(cyberbattlesim): implement the conformant simulator backend target #27 ← tests/test_cyberbattlesim_backend.py, feat(cyberbattlesim): implement the conformant simulator backend target #27 ← tests/test_cyberbattlesim_qualification.py, feat(cyberbattlesim): implement the conformant simulator backend target #27 ← tests/test_cyborg_qualification.py, feat(cyberbattlesim): implement the conformant simulator backend target #27 ← tests/test_cyborg_source_ledger.py

Checklist

• Code follows project coding standards (docs/CODING_STANDARDS.md)
• No business logic in API layer
• Domain layer has no framework imports
• Envers @Audited on new entities if applicable
• Changelog: owned by Release Please (generated from the Conventional Commit PR title; no per-PR fragment)
• Architectural docs updated if stack, package structure, or key behaviors changed