feat(examples): add reproducible industrial presenter walkthrough

[carloshvp]

The industrial example currently needs three terminals and manual service cleanup. This adds a reproducible, presenter-controlled walkthrough showing why an in-envelope motion still needs workflow authorization.

python present.py starts local cMCP and the simulated controller, then advances through six screens with five Enter presses: mission, undeclared-workflow denial, declared-workflow authorization, session close and service shutdown, offline verification, and rejection of a tampered copy. The controller's measured motion-request counter stays 0 for the denied request and becomes 1 for the authorized request. Every state-read/motion pair stays together so presenter pauses do not weaken the five-second token expiry.

• Add a complete, hashed Python 3.11 release lock, a timed script, retained logs and fresh evidence directories.
• Stop only launcher-owned processes, including on interruption, closed input and partial startup failure; refuse occupied ports and support immediate reruns.
• Verify saved TRACE and controller receipts after shutdown, requiring a receipt before reporting success.
• Extend the existing industrial CI job with the live suite under its existing dependency-install policy. Preserve the original three-scenario runner and the policy, catalog, manifest and signed fixtures.

Reproduce this PR before merge:

git clone --branch industrial-presenter-demo https://github.com/agentrust-io/integrations.git
cd integrations/examples/industrial-embodied-ai
python3.11 -m venv .venv
source .venv/bin/activate
python -m pip install --require-hashes -r requirements-presenter.txt
python present.py --auto
python present.py

Validation on macOS with Python 3.11.12 and a fresh environment installed from the hash lock: 22 unit tests, five live tests, committed artifact validation, Ruff and local documentation links passed. Live tests cover two fresh runs, both first pauses beyond five seconds, offline verification with socket operations forbidden, altered/missing evidence, the original three-path runner, Ctrl+C, EOF and partial startup cleanup. The Linux industrial CI job also passed all 22 unit tests, five live tests, and committed artifact validation.

Evidence remains explicitly software-only. The controller uses a public teaching key; signatures do not establish hardware provenance or physical completion. Agent Manifest validation remains offline, without manifest-to-session identity binding. Forwarding counters are diagnostic observations, not signed hardware telemetry. No frontend or robot hardware is required.

Requested and directed by @carloshvp; implemented with AI assistance.

[imran-siddique]

Approving 04043d9. Here, from the hash lock on Python 3.12: 22 controller tests pass and validate_artifacts.py reports 2 valid receipts. The live suite will not start on Windows (SIGINT unsupported, WinError 10013 binding 8443), which PRESENTING.md:16 already scopes to macOS and Linux; the hosted Linux job ran all 5 live tests OK. The links failure is two 503s in unchanged READMEs (alakris-authority-comparison, litzki-systems-sovp), and both URLs return 200 now, so a rerun should clear it.

[imran-siddique]

Mutation: replacing if not receipts: with if False: still passes all 5 tests in test_presenter.py. Only the stripped-bundle check at tests/live_presenter.py:96 guards it, and that runs on Linux CI alone. A unit test calling verify() on a bundle with no receipts would pin it anywhere.