feat: add pinned live runtime updates

[eightmm]

Summary

• separate the stable Codex host bootstrap from immutable, receipt-pinned scientific runtimes
• make installer and live-update recovery safe on uv-managed Python, with explicit bootstrap migration gates
• fail closed at hook, MCP, and provenance boundaries while improving human-readable run reports

Test plan

• ./scripts/check.sh fast
• python3 scripts/validate_release.py --base-ref origin/main
• focused runtime-state, MCP proxy, hook dispatch, installer recovery, provenance, and artifact-index regression tests
• independent full-diff review with no blocking findings