chore(s7commplus): verify SessionKey artifacts

[gijzelaerr]

Addresses the artifact provenance and deterministic verification portion of #828. This is intentionally the first incremental, behavior-neutral slice.

Summary

• add an authoritative per-file manifest for all 30 generated SessionKey runtime artifacts
• pin HarpoS7 v1.1.0 to immutable revision b4ba7fab14bcca4274e69a4d6524a5a61fcd329d and record source, generation status, size, and SHA-256
• add one-command verification with actionable missing, changed, extra, duplicate, and out-of-tree diagnostics
• run verification in existing pre-commit CI whenever the manifest, verifier, or generated tree changes
• document the handwritten/generated review boundary and safe new-family extension point
• package the manifest, architecture guide, and upstream license in wheel/sdist releases

No authentication implementation or generated artifact changes in this PR. Full extraction/regeneration tooling for constant tables remains a documented follow-up; until it is vendored, deterministic hash verification is authoritative.

Verification

• uv run pre-commit run --all-files (including new artifact verifier)
• .venv/bin/pytest — 2,076 passed, 82 skipped
• uv build — wheel and sdist built successfully
• inspected wheel contents for manifest, guide, license, and four runtime binary tables