fix: ship Vifty recovery and fan-control repair

[Reedtrullz]

Summary

• complete the Vifty recovery and lean-polish hardening already validated in the worktree
• fix AppleSMC write-envelope sizing and bounded target/Auto readback retries
• preserve fail-closed helper, installer, agent, release, and evidence contracts

Validation

• RELEASE_METADATA_MODE=developer-id make verify-full SWIFT_BUILD_PATH="$PWD/.build"
• 2054 XCTest cases passed
• all Ruby trust suites passed
• git diff --check passed

Live Fixed/Curve/Auto hardware evidence is documented separately and remains distinct from public-release evidence.