feat: add support for nexus and rapier backends

[heyong4725]

Supersedes #594 so the reviewed fixes can run through CI. PR #594 comes from
dimforge/aisle with maintainer edits disabled; this branch contains its exact
history through 45b76f6 plus the review fixes below.

Summary

• add Nexus and Rapier simulation backends behind the existing engine contract
• attest the selected engine and build in rollout manifests
• require clean source receipts for out-of-lock Nexus and Rapier wheels
• bind the CSE v27 and pilot v13 freeze manifests to a commit containing their recorded rollout bytes
• update ADR-67 to describe the implemented receipt and runtime behavior

Validation

• uv run ruff format --check .
• uv run ruff check .
• uv run python tools/trace_check.py
• 90 focused unit, freeze registry, and docs tests passed
• both affected harness freeze check --allow-withheld-seeds checks passed with zero drift
• full unit run reached 780 passes before an unrelated macOS worker sandbox test returned infrastructure_exclusion; the original PR documents that its remaining full-tier failures reproduce on main

Original performance results and engine details remain in #594.