Support reviewed Bombadil toolchain overrides

[0thernet]

Summary

• add an exact reviewed Bombadil toolchain override contract with source revision, build contract, version, and SHA-256 identity
• attest, snapshot, probe, re-attest, and safely clean the private executable while stripping coordination inputs from child environments and public receipts
• bound executable attestation at 64 MiB and cover hostile replacement, writer settlement, cleanup, packaging, and release-history cases
• prepare immutable package version 0.7.19

Validation

• focused typecheck and runner/export tests: 129 pass, 0 fail, 684 assertions
• canonical full gate: 405 pass, 0 fail, 69,798 assertions; npm release recovery, package smoke, lint, Todo production/Direct verification, and React Native verification green
• generated bundle regenerated and reviewed; worktree clean at exact commit 60f0920