docs: reconcile desktop and remote substrate evidence

[abrichr]

Summary

• replaces stale Experimental/Research/Early/Exploratory substrate descriptions with the implemented and counted Windows, macOS, Linux, RDP, and Citrix evidence
• documents the dedicated --backend citrix selector, exact Workspace-window/readiness binding, governed run, durable resume, and retained 3+3 code-readiness record
• keeps ICA/HDX qualification explicitly separate from RDP and no-DOM stand-in evidence without framing the implemented backend as missing
• extends the signed openadapt.runtime-validation/v2 producer contract with a report-derived, HMAC-bound target_kind (web|windows|macos|linux|rdp|citrix)
• preserves the exact HTTPS/public-DNS execution boundary for web while native/remote attestations expose an empty execution object and retain only the opaque environment digest
• makes BYOC dispatch routing first-class and fail-closed: the connector requires the signed closed substrate, routes the exact backend, and refuses missing, conflicting, or relabeled outcomes
• binds BYOC execution to the exact approved sanitized ZIP bytes: required archive SHA-256, copy/hash before safe extraction, no unpacked-directory shortcut, and no unverified digest echoed in callbacks
• updates the claim registry, generated verification views, and reviewed public artifact inventory
• reconciles Desktop status with the published v0.9.0 Windows/macOS/Linux installers

Validation

• runtime-validation/backend/hosted/macOS-harness focused suite: 375 passed, 1 skipped
• BYOC connector archive/substrate contract: 32 passed
• full local non-e2e suite: 3,015 passed, 18 skipped; two local Anaconda scikit-image/NumPy ABI failures were isolated, and the same pixel-probe file passed 11/11 in a clean isolated Python 3.11 dev environment
• mypy passed on all changed runtime and connector modules
• Ruff check and format check passed
• python scripts/validate_claims.py --check
• python scripts/check_consistency.py
• wheel and sdist built; the exact archives passed scripts/check_release_consistency.py --validate-dist-dir
• archive inspection found no openIMIS/AGPL material or private deployment corpus
• git diff --check

Evidence and trust boundary

The Citrix artifact records code_readiness_accepted=true and ica_hdx_accepted=false. The required CI lane separately covers its backend, readiness refusal, governed run, durable resume, report binding, and no-DOM stand-in driver. A counted live ICA/HDX record remains bound to its exact deployment.

The macOS AX release harness is finite and fail-closed: 3 healthy exact-effect trials, 3 one-glyph pre-write identity refusals, and 3 ambiguity pre-write refusals, with no retries and explicit cleanup/adjudication. Its live batch will be attached as a later commit after the host grants Screen Recording and Accessibility to the qualifying Codex/Python process.

Cloud and Flow share the same v2 canonical HMAC vector. Cloud keeps legacy v1 strictly web-only. All existing bundle hash, certification, policy, identity, effect, egress, and data-boundary refusals remain intact.

This PR remains draft/unmerged until the independent cross-repository review and the finite macOS evidence run complete.