security: add restricted real-agent scale evidence producer

[rblake2320]

Problem

The ecosystem scale-readiness gate cannot safely consume the legacy real-agent v3 runner. That runner uses provider bypass/trust-skip flags, broad inherited environment state, timestamp-derived nonces, loose HWND discovery, and model-call claims that are not directly observable.

Scope

Add a separate, versioned restricted scale producer that:

• requires a disposable fresh checkout verified against canonical remote HEAD;
• rejects unsafe provider flags;
• constructs provider-specific environment allowlists;
• uses cryptographic random nonces;
• binds each HWND to the spawned process tree and verifies PID, executable, class, and exact title;
• records CLI invocation accounting only;
• emits per-rung UTC start/end timestamps and structured guard/cleanup evidence;
• fails closed for stale/future timing and incomplete cleanup.

Add adversarial unit tests. Do not run live providers, merge, or make readiness claims in this issue.

[rblake2320]

Reopened after PR #29 auto-closed it. PR #29 closes the cleanup/evidence-ordering mechanism gap only. The protected-runner 10/15/20 execution, artifact attestation, ecosystem consumer acceptance, and independent evidence review remain required.