Verify resident macdoc before SessionStart trust

[kiki830621]

Refs #161

Summary

• stop executing the resident macdoc binary during SessionStart
• require Developer ID, exact v0.7.0 SHA, and installer sidecar before the zero-network fast path
• isolate trust-chain tools from user-writable PATH and verify download pin/bytes/signature before install
• add hostile environment and real signed-fixture regression coverage
• publish shell version 1.4.1 while retaining binary 0.7.0

Verification

• adversarial SessionStart test passed with real signed v0.7.0 fixture
• release-pin, bytes-pin, and codesign negative gates passed independently
• requirements, logic, security, regression, and Devil’s Advocate reviews passed after six rounds
• ShellCheck, bash syntax, JSON metadata, and diff checks passed

Checklist

• Diagnose
• Implement (6 commits)
• Verify-gated PASS
• No automatic GitHub closing trailer

After merge, use the explicit IDD closing workflow for issue 161.