Validate Context Firewall packet-v1 receipts

[sneakocom]

Summary

• add a dependency-free Context Firewall packet-v1 validator with receipt-only and source-backed verification
• independently verify canonical hashes, line provenance, classification, suppression accounting, measurements, and NEEDS_RAW_EVIDENCE semantics
• add a machine-readable CLI, 24 public-safe conformance vectors, CI, and exact-revision interoperability tooling

Verification

• npm run lint
• npm test: 46/46 passed
• npm run conformance: 24/24 vectors passed
• Context Firewall interoperability: 5/5 passed against dd34bd9f681314761f1ca87f339648bf611811f3
• tampered packet rejected as CRYPTOGRAPHIC_MISMATCH
• gitleaks: no leaks found
• git diff --check: passed

Boundary

No model/provider experiment was run. This validates receipts; it does not establish that reduced evidence preserves model correctness, and EXP-001 remains PLANNED.