feat: add protected Chongqing admission attestation intake

[zhouning]

Summary

• add the M3-32 protected attestation intake/evaluate/verify contract
• bind all 15 external requirements to M3-31 logical/file fingerprints with freshness and no-payload/no-mutation checks
• wire CI and staging parity tests; document ADR-079 and roadmap status

Validation

• 727 required platform tests passed locally
• M3-32 and staging parity tests passed
• Ruff and git diff --check passed

The checked baseline remains blocked: no external attestation is present, no source content is admitted, and no Landing/Run/provider authority is created.