feat: live Shelby integration + preflight + hardening

[Rishidar-lab]

Summary

This PR evolves sealbox from a mock-tested scaffold into a live, Early-Access-ready Shelby integration.

Hardened seal & verify

• Exponential backoff + retry on transient S3/network errors
• Detects anonymous-mode rate limits vs authenticated; surfaces clear guidance
• seal: detects insufficient ShelbyUSD and prints exact faucet URL
• verify: tolerates short blob-propagation delay; cleanly distinguishes PASS / TAMPERED / NOT-FOUND

New sealbox doctor command

• Validates .env completeness
• Pings the S3 endpoint
• Checks APT + ShelbyUSD balances via Aptos fullnode
• Prints READY / NOT-READY checklist without logging secrets

--json flag on all commands

Scripting-friendly output on seal, verify, and list.

Manifest hardening

• Atomic writes (write-to-tmp + rename)
• schemaVersion field
• Deduplication by sha256

CI

• Repaired mocked unit-test job (install/build/lint/test)
• Added optional live-integration job (manual workflow_dispatch only, requires repo secrets)

Docs

• Live walkthrough in README
• SECURITY.md with key-handling warnings
• CONTRIBUTING.md, CHANGELOG.md
• Updated .env.example with correct shelbynet endpoint

Testing

All 12 unit tests pass with network fully mocked.