feat(lattice): add Carbon and Axle reference fragments

[mgazza]

Summary

• add a generic durable REFERENCE-only data-feed fragment publisher
• add pure Carbon and Axle normalizers without importing or editing live integrations
• invalidate the existing compiler on accepted source, liveness, and removal generations
• keep every role, identity assertion, config projection, capability, and control authority empty

Identity and privacy

• Carbon/Axle snapshots are bound to one canonical provider ID and rejected by another publisher
• raw postcode, managed-site ID, and BYOK installation-local ID are never retained
• caller supplies a 16–128 byte installation privacy key; identifiers use domain-separated,
  length-prefixed HMAC-SHA256 and retain only a 128-bit provider-local opaque reference
• keys and raw identifiers are absent from objects, snapshots, errors, reprs, causes, and contexts
• controls, NULs, oversize values, and unpaired Unicode surrogates fail with value-free errors
• no ProviderIdentityAlias is emitted, so matching opaque references cannot correlate providers

Safety

• default-off, unseeded, unregistered, and disconnected from live Carbon/Axle code
• authority zero, empty capabilities/roles/config projections, REFERENCE aliases only
• monotonic caller generation; replay/regression inert and same-generation mutation rejected
• liveness advances independently; feedback tokens retain existing suppression behavior
• durable irreversible tombstone survives restart and cannot re-enrol
• no VPP/session/control state is projected

Validation

• 189 relevant tests pass on Python 3.9 and Python 3.14
• full pre-commit hooks pass
• independent review: two request-changes/fix cycles followed by approval
• fresh GitNexus index is additive; no live modules import these files

Train

• base: fix(lattice): compile durable fragment tombstones #4348
• tracking: Predictive-Cloud-Ltd/predbat-saas-infra#561 and Update bug_report.md #466