Add restricted POSIX PAX archive profile

[blisspixel]

Summary

• add an explicitly selected restricted raw POSIX PAX profile with exact local x and global g state over canonical path and size records
• preserve all existing ZIP, ZIP64, portable ustar, gzip-wrapped ustar, policy, IR, and identity bytes
• add PAX-native evidence, independent covering and state replay, TreeV5 layout identity, retained reads, and atomic materialization
• keep the runtime dependency graph unchanged and extend release promotion to one seventh bounded fuzz job

Assurance

• byte-exact GNU tar 1.35, libarchive 3.8.4 paxr, and CPython 3.12.10 producer fixtures
• nine digest-pinned deterministic PAX fuzz seeds with exact workflow and resource-bound verification
• standalone identity reconstruction without depending on the Sealr crate
• exact crate membership, packaged consumer, native Windows package, documentation, license, dependency-budget, and supply-chain checks
• complete security diff review across all 78 changed paths; one assurance-only auditor differential was fixed and independently regression-reviewed before this PR

Validation

• cargo fmt --all -- --check
• cargo clippy --locked --workspace --all-targets --all-features -- -D warnings
• cargo test --locked --workspace --all-features
• scripts/verify_docs.ps1
• scripts/verify_assurance.ps1
• scripts/verify_dependency_budget.ps1
• scripts/verify_fuzz_seeds.ps1
• scripts/verify_walkthrough_assets.ps1
• scripts/verify_crate_package.ps1
• release-mode Windows native package and verification
• cargo doc with warnings denied
• cargo deny for the workspace, fuzz crate, Kani crate, and packaged consumer
• three target-specific third-party license bundles

Release boundary

This prepares v0.1.0-alpha.11. Main keeps exactly one strict protected Required CI check. Tagging and publication will occur only after the merged main commit passes Required CI and all seven exact-commit bounded fuzz jobs.