Qualify bounded complete-record sampling with typed policy and hosted CI

[EHotwagner]

Summary

• replace the flat /usr/lib late-bound runtime glob with a bounded loader-cache census
• admit resolved ICU, crypto, SSL, Brotli, zlib, and zstd libraries across platform library layouts
• add a genuine compiled-policy control proving omission of ICU refuses at current-process
• retain the staged runtime, startup diagnostic, TypeScript Quint backend, five-second deadline, and all custody guards

Verification

• startup preflight pinned ICU 6, crypto 1, SSL 1, Brotli 3, zlib 1, and zstd 1 resolved libraries
• removing ICU from an otherwise valid closure produced policy-artifact / current-process:exception
• the complete closure reached a genuine ready frame and the valid full correspondence passed
• 27 canonical tests, 500 traces at 16 steps, all 14 ITFs, compiled replay, and mutation controls passed
• Release build completed with zero warnings and errors