Add fail-closed recipe sandbox qualification

[dovvnloading]

Summary

• add a disposable Windows recipe sandbox qualification harness
• compose fixed AppContainer isolation, Job Object cancellation, and hostile decoder corpus checks
• fail closed on missing signed worker provenance, resource/accounting controls, and broker PID/token binding
• document the sandbox qualification ADR and keep provider/lifecycle enablement blocked

Verification

• python -m pytest -q (209 passed, 1 skipped)
• python -m pytest tests/test_recipe_sandbox_qualification.py -q (5 passed)
• python tools/execution_spikes/recipe_sandbox_qualification.py --strict --json (expected exit 2: signed worker/resource/broker gates blocked; provider_launch_authorized=false)
• frontend lint, typecheck, build, and 39 tests passed
• compileall, Ruff, contract generation, and diff check passed

The unrelated working-tree edit to Cortex.pyproj is intentionally not included.