Add fail-closed production promotion audit

[rsasaki0109]

What changed

• Add an 11-gate, machine-readable production promotion contract and fail-closed auditor.
• Add a deterministic two-hour ROS 2 continuity soak with duplicate, timestamp, outage, restart, bounded-state, and recovery checks.
• Fix watchdog trip accounting when a non-watchdog sensor ingest causes the transition to safe fallback.
• Exercise the installed lifecycle node during the ROS 2 image build.
• Publish the 10/11 promotion state and exact Tokyo 31.3989% vs 45% gap in the release report and audit page.
• Extend the reproducibility bundle to include the promotion contract and soak artifact.

Why

The v0.3 release evidence needed one authoritative promotion decision instead of separately interpreted artifacts. The audit now proves truth-free input, full-denominator gain without loss, false-FIX zero, latency, multi-city non-degradation, M4 preservation, deterministic replay, ROS continuity, and reproducibility while keeping promotion closed on the unmet Tokyo accuracy KPI.

The soak also exposed a watchdog counter bug: input ingestion could enter safe fallback before watchdog() ran, leaving watchdog_trips at zero. Transition accounting now lives in the common mode-update path.

Validation

• bash scripts/ci/run_python_smoke.sh — 320 passed, 1 skipped
• Focused promotion/ROS/release suite — 28 passed
• python -m ruff check ... — passed
• git diff --check — passed
• Locked two-hour soak — passed, 360,000 ticks, final mode normal

Docker is not installed on the local Windows host; the existing container CI is expected to validate the Dockerfile lifecycle-node smoke.