Bind signed bundles to the image worker role

[dovvnloading]

Summary

• add storage-only worker provenance verification after signed bundle installation
• require exactly one image_transform role at
  ecipe_worker.exe
• revalidate manifest/state digest, declared bytes, file identity, size, and SHA-256
• reject missing, ambiguous, mismatched, tampered, hardlinked, or reparse entries
• keep native launch, OS resource controls, broker PID/token binding, and lifecycle enablement blocked

Verification

• python -m pytest -q (215 passed, 1 skipped)
• worker/installer provenance corpus (12 focused tests; 6 worker tests)
• export/lifecycle cross-check: verifier exported, RecipeImageProvider not exported, lifecycle default disabled
• compileall, Ruff, contract generation, and diff check passed

The unrelated working-tree edit to Cortex.pyproj is intentionally not included.