Add standalone devnet W009/W011 reference harness

[mizuki0x]

Summary

• publish a signed v3 devnet artifact for one W009 authorization path and one fixed W011 Memo-refutation scenario
• pin root-signed, run-versioned role documents instead of trusting keys from the bundle
• reserve W009 consumption durably before signing, with immutable input snapshots and mutation regressions
• verify exact recorded Solana wires, slots, block times, finality, and devnet genesis offline or against RPC

Boundary

This is a standalone reference harness, not a production daemon, wallet integration, or general W009/W011 enforcement claim. W011 is a fixed scripted Memo-only scenario with declared event-parent lineage, not dynamic taint tracking. Role keys are separately keyed but loaded by one process under one operator. A direct signer or arbitrary submit callback outside this harness can bypass it. The exported helper does not independently bind a caller callback to devnet; the recorder script supplies that boundary. Concurrent legacy and canonical replay executors are unsupported.

Verification

• pnpm --dir services/witness-verifier test — 57 passed
• offline v3 verification with --require-devnet-record — passed
• live https://api.devnet.solana.com verification — exact records and devnet genesis verified
• v3 artifact SHA-256: ae7f6e906253e6d8385cd30e6c227e5729fa073f2541b0c38d0c914fe911c89f
• git diff --check — passed

The PR stays draft until the harness boundary and public wording are reviewed.