feat(eval): prepare August ClinVar freeze execution

[srinivasdrona]

Summary

• add the offline Stage 1-2 execution harness for ADR-0020
• add an exact-source HTTPS transport with strict URL/TLS/no-redirect/bounded-streaming policy
• add cross-EOL approval hashing, external-root/run-scope preflight, and committed-tree implementation-freeze verification
• add an immutable prospective overlay, inert draft approval, and operator handoff documentation

Safety boundary

This PR performs no live ClinVar HEAD/GET/download, no label or row inspection, no benchmark/scoring, and no authorization. The repository approval remains DRAFT_PENDING_ADR_0008_X64_WORKER_VERIFICATION, all access attestations are false, and --execute requires a separately supplied valid approval plus explicit transport/date/MD5 lookup factories.

Review history

• Codex RED tests iterated through adversarial findings
• Sonnet implementation
• Opus final committed-tree verdict: PASS
• fail-closed coverage includes redirects, malformed headers, path/symlink/special files, overflow cleanup, record hash chains, TOCTOU, concurrency, Git-unavailable/unresolvable implementation pins, and typed operator exits

Validation

• WSL interpreter: /home/sdrona/raptor/bin/python (Python 3.12.3)
• focused ClinVar/harness suite: 155 passed, 3 skipped
• authoritative full suite: 1,799 passed, 23 skipped, 0 failed
• git diff --check: clean
• working tree: clean
• no network/download/archive/temp artifacts

Commits

• 9ac9f90 — offline harness, transport, overlay, draft and tests
• 06299eb — repin draft implementation freeze to committed module blobs