Add safe installed Forge 2.7.22 update controller

[pcvantol]

Summary

• add a bounded external controller for the selected installed Forge 2.7.21 to 2.7.22 transition
• bind the exact terminal release receipt and published wheel, verify all installed bytes before execution, and retain the legacy route for pre-migration recovery
• qualify Forge's owning schema migration on an isolated copy, then install it atomically under runtime, bootstrap, SQLite, and resolver fences
• add crash, tamper, late-writer, path, preservation, and exact-published-wheel qualification

Validation

• scripts/validate.sh: 737 tests passed, 1 opt-in exact-artifact test skipped; product version PASS; offline projection PASS
• exact published wheel + terminal receipt end-to-end: PASS, including idempotent replay
• independent quality and security reviews requested for e36c393

No operational reset, Mission, Action, provider, credential mutation, service start, or EP submission is performed by this controller.