Fix offline source custody restoration

[coneilen]

Summary

Fix the Windows Dev Box handoff so candidate source with Git LFS content can be restored offline at the exact detached revision with a clean worktree. The beta2 candidate, tag, product ZIP, and original handoff remain immutable.

Changes

• Add a deterministic source-custody ZIP containing the verified Git bundle, exact candidate-tree LFS objects, integrity manifest, and standalone Windows PowerShell restore script.
• Restore pointer blobs with smudging disabled, seed verified local LFS storage, materialize with offline git lfs checkout, and enforce exact HEAD/tag identity plus empty git status --short.
• Register focused custody coverage in packaging contracts and update local/Dev Box plans to use the new artifact.
• Correct the beta2 ledger so the stopped bundle restore is not passing evidence and all seven release gates remain open.

Test plan

RED: pwsh -NoProfile -File Tools\windows\Tests\SourceCustody.Tests.ps1 -> RED: source custody tool is missing
GREEN: pwsh -NoProfile -File Tools\windows\Tests\SourceCustody.Tests.ps1 -> 4/4 passed, including offline Windows PowerShell 5.1 restore
REGRESSION: pwsh -NoProfile -File Tools\windows\validate.ps1 -Task packaging -PackagingPart contracts -> passed

Additional end-to-end validation restored candidate a406a28cb9aec856c934e7253d1a79c2cc6706ed offline with 43/43 LFS files materialized, exact temporary validation tag peeling, and empty git status --short.

Checklist

• I have read the Contributing Guidelines
• I have signed off my commits (git commit -s) per the DCO
• Tests pass locally (make test)
• Code follows the existing style (make check)
• I added the test/contract before the implementation and observed the intended RED failure