feat: add generation capsule evidence mechanics

[dKosarevsky]

Summary

• add canonical, bounded, provenance-bound generation capsule preparation, planning, and verification
• add strict provider attempt evidence, lifecycle journals, crash recovery, captured-input-only resume, and stable CLI contracts
• preserve legacy v1 behavior while extending credential-free Ubuntu and macOS capsule coverage

Test plan

• uv run ruff format --check .
• uv run ruff check .
• uv run mypy src
• uv run pytest -q — 2715 passed, 1 expected filesystem skip
• focused Slice 3 integration — 1054 passed
• uv build and clean-wheel console-script acceptance