Complete Project-aware Agnir bootstrap acceptance

[mattamior]

Scope

Complete the Principal's version-selection correction on top of main 9501fd7ed0843f46882ee63ed9c19cd2759a7cb2: preserve valid existing Agnir compatibility and operational provenance; only truly new Projects resolve latest published stable. No Platform publication, tags, existing-Project migration or live Cloudflare effects.

Implemented

• Existing resume is offline; absent optional historical package provenance never means uninitialized.
• New bootstrap validates a same-operation canonical stable release, exact commit and Git-verified installer/contract/schema bytes. Package SemVer is distinct from Core/profile. Unsupported/unavailable latest fails before initialization, without fallback.
• Native model exercise receives this trusted freshly resolved installer source outside its still-uninitialized Project. Its sandbox stays network-restricted. Independent postcheck requires exact stable compatibility, binding and applied provenance.
• Executable positive/negative checker regressions for 0.1/0.2/1.0 preservation, future package patch selection, mismatched binding/provenance, RC/unpublished/unsupported upstream and lookup failure.
• Bilingual first-use diagrams now show selected-release AGNIR.md activation without migrating this repository's own existing activation.

Exact candidate

Commit 08f2c7c7581edb8845cea161b971a0c4dca2de4d; tree 3c053b2371f0fe916379ac7ea2f74ce1eb4bad3f; Plugin tree 77953ba954b2c0f3ff7dcc6f9c7814df5fa05e12.
Local and isolated Linux validation: 141 tests, repository integrity, portable contracts and diff checks passed.
Inner ZIP SHA-256 08ad8bb13657c359d799d66c9adafcd552f8d6afdd27ed1ad96d4e34e093911b, independently byte-compared to every source Plugin file.

Auxiliary receipts, not whole-run success

One-shot run 35520533567 successfully tested, resolved live Agnir v1.0.2 at b5626394ec40a5cb7a28c01892acde07cc0adc8e (Core/profile 1.0), built the ZIP and materialized this exact tree; its final summary command failed (git rev-parse :plugin). Artifact 10607369559 retains genuine tests/live-resolution/ZIP receipts. Corrected-summary run 35520615978 passed tests but then hit public GitHub HTTP 403 rate limiting; bootstrap failed closed as intended. Both auxiliary runs remain failures, not green acceptance claims. The one-shot workflow is absent from the candidate tree.

Remaining

Read this PR's complete multi-platform CI/native install artifacts, reconcile Agnir state and then verify authoritative main. No-auth installation and structural/unit checks do not prove authenticated model bootstrap/task/checkpoint/fresh-session behavior; that broader gate remains open.