Add portable ustar and multi-format core

[blisspixel]

Outcome

This establishes the first multi-format release foundation while preserving the existing ZIP identity contract.

• adds an explicit, zero-new-dependency raw POSIX ustar profile
• introduces policy v2 with explicit archive-format selection
• separates ZIP and TAR format-native member and archive evidence
• binds payload access to validated snapshot domains, ranges, codecs, sizes, and integrity
• adds deterministic TAR producer fixtures, conformance checks, a packaged consumer, and native package smoke coverage
• adds a third bounded fuzz target for raw POSIX ustar alongside the worker-protocol and semantic-record targets
• synchronizes the README, roadmap, support matrix, assurance material, and Alpha9 release contract

Assurance

• debug and release workspace test suites pass with all features
• strict workspace clippy passes with warnings denied
• documentation, fuzz-seed, assurance, package, native archive, release-candidate, and packaged-consumer verification pass
• package contents are pinned to exactly 58 files
• all three fuzz targets have deterministic seed manifests
• the security diff review completed with full changed-code coverage and no reportable findings
• no runtime dependencies were added

Scope boundary

This release supports raw portable ustar only. ZIP64 and derived compression domains are intentionally rejected until their identity and bounded-transformation contracts are implemented. The next delivery sequence is ZIP64, transformation-profile identity, then gzip/TAR.