Add verified-session evidence bundle + wire JA3 oracle into diagnostics

[maybeknott]

Summary

This PR analyzes the proposed integration ideas against the actual state of the repository and lands only the genuinely missing, high-value pieces. Most of the proposal (shared ProjectState/CheckResult/RepairAction, listener-exposure detection, GUI dashboard next-action, ADRs, maintainer map, release artifact verifier, tests-out-of-scripts) was already implemented. The two concrete items still open in ROADMAP.md were:

1. Verified runtime session evidence bundle command — was: Planned
2. JA3 oracle workflow wiring into the runtime probe — was: helper existed, not wired

Both are now done, built on the existing readiness layer rather than duplicating it.

Changes

• scripts/browser_diagnostics.py — opt-in --ja3-oracle / --expected-ja3. When supplied, the stock-Chromium probe measures JA3 via the existing verify_ja3_against_oracle helper and records it in fingerprint_validation. Without an oracle it stays not_measured — no fabricated fingerprint match (honors ADR-0004).
• scripts/verified_session.py (new) — composes ProjectState + optional page check + optional JA3 oracle into one redacted runtime-evidence.json:
  • drops PID, basenames the listener process path, redacts repo root
  • records config_sha256 + per-profile hashes so evidence ties to an exact compiled config
  • keeps page check not_run and JA3 not_measured unless explicitly requested
• main.py — new verified-session subcommand; registers the new test in the offline suite.
• Tests — verified_session_tests.py (bundle shape, redaction, honest JA3 defaults, sha256 config hash) and probe-signature assertions in browser_probe_semantics_test.py; both new files added to the repository-structure manifest.
• Docs — ROADMAP.md gaps updated; README.md documents the command and its redaction/JA3-honesty rules.

Why the rest of the proposal was not implemented

The larger architectural suggestions (PyO3 embedding, Cap'n Proto IPC, Tauri/Slint migration, io_uring/eBPF, TCP sequence-injection, embedding the Rust core into Xray) are interesting but conflict with the project's established, deliberately-honest architecture (Xray as runtime source of truth — ADR-0001; browser-proxy-first — ADR-0003) and would be large, risky rewrites rather than coherence improvements. They are better tracked as research items, not merged speculatively.

Testing

py -3 main.py test   ->  All 34 checks passed

Manual: py -3 main.py verified-session --skip-runtime --skip-trust produces a redacted bundle (root <redacted>, no PID, JA3 not_measured); output path .local-state/runtime-evidence.json is gitignored.