feat(alpha): add verifiable LAN evidence kit

[ovasylenko]

Outcome

Turns the manual LAN alpha report comparison into a canonical, fail-closed evidence gate.

Changes

• adds a Rust-authoritative schema-v1 redacted match report with generated TypeScript bindings
• makes desktop export and opencade-match-probe emit the same privacy-minimized JSON shape
• adds opencade-match-verify for paired host/guest validation with stable error codes and bounded 64 KiB inputs
• requires finished state, opposite roles, direct UDP, exactly 60 frames, matching room/game, and matching checksum
• builds both Windows LAN tools in CI and publishes them from successful main runs
• updates the physical LAN alpha guide and implementation status

Verification

• cargo fmt --all -- --check
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• cargo test --workspace --all-features --locked with isolated PostgreSQL 16: 89 passed
• real two-process UDP probe plus verifier: passed
• desktop cargo check and clippy with locked dependencies: passed
• pnpm format:check, typecheck, test: 26 passed, build
• docker compose config --quiet
• release build of both networking binaries

Opportunity gate

This is the evidence-first LAN Alpha Kit. NAT traversal remains intentionally gated until ten physical Windows LAN attempts produce at least eight verified report pairs.