Restore board mutations for CFB27 Patch 1

[eric-levinson]

What changed

• Adds an exact executable build registry with diagnostic and certified states.
• Re-anchors recruiting board add/remove handlers and runtime object layouts for the July 16 Patch 1 executable.
• Adds a fail-closed, evidence-gated workflow for re-anchoring future game updates.
• Makes runtime discovery allocation-race-safe, scans writable private memory in one snapshot pass, and caches only continuously validated objects and tables.
• Extends the SDK's default board-mutation deadline to cover first-use discovery while preserving explicitly configured client timeouts.

Why

Patch 1 changed the game executable, invalidating the previous handler RVAs, vtables, descriptor identities, and table references. The old runtime discovery also reread the full writable address space five times, which could outlive the client timeout and leave the single pipe worker busy.

Impact

Certified offline Patch 1 sessions can use addBoard and removeBoard again. Unsupported or merely diagnostic builds remain write-disabled. Future executable updates now follow a repeatable capture, analysis, transition-check, and explicit certification process instead of accepting hand-entered offsets.

Validation

• Live Patch 1 acceptance: add, remove, and re-add all returned applied_verified; final state left Pearson on the board.
• First discovery completed in 65 seconds; validated cached calls completed in 25–30 ms.
• npm run check
• npm test: 277 passed
• Full Release native build
• All 16 documented native smoke harnesses passed
• Installed host artifact SHA-256 matched the tested build: 2D380A7505263179542075193C5C342AC04AD5A672EA95CEF968634B4E24D192