Add keyed semantic expression protection

[imakris]

Summary

• route clear and protected expressions through one semantic compiler boundary
• add move-only protected keys, authenticated format 1.0 codec, streaming runtime loading, numeric-slot bindings, lifecycle erasure, and source-free fallback
• add dependency-isolated CMake, Conan, and vcpkg protected packages
• add the safe no-overwrite mexce_protect issuer, installed example, threat-model documentation, release CI, and seeded structured fuzzing
• add phase-isolated protected performance/resource benchmarks and release acceptance limits

Verification

• clear corpus: 44,229/44,229 correct on MSVC, GCC 13, and Clang 18 with identical backend counts
• protected acceptance: 216 isolated measurements per compiler, zero bad results, stable equal backends
• exact resource artifact: 16,384 records / 802,880 bytes
• final MSVC CTest: 10/10 passed
• GCC 13 and Clang 18 protected orchestrator/resource gates passed
• MSVC/GCC/Clang issuer publication suites passed, including synchronized path-replacement cases
• CMake installed consumers, Conan ordinary/protected packages, and vcpkg candidate overlays passed
• sanitizers, structured fuzzing, mixed-TU, cross-platform artifacts, and ordinary no-sodium isolation passed in their owning batches

Performance

See analysis/performance_acceptance.md for retained distributions, profiles, limits, failures, and tool availability. No production optimization was retained; a measured MSVC force-inline experiment regressed and was removed.

Notes

• protected expressions are opt-in and x64-only; ordinary x86 support remains
• ordinary mexce::mexce remains dependency-free
• remote GitHub Actions are expected to provide the final hosted release-matrix evidence