QorCap v0.3.31: pairing and corroboration sidecars

receipt.v0.json is unchanged. Two-sided corroboration is a separate indicator and never changes the verdict. It has not yet been tested on a real two-player match.

• PR #64: qorcap submit uploads score_timeline.json, device_attest.v0.json, and pairing.json when they exist. qorcap pair create asks the QorTime referee for a pairing token (POST /v1/pairings) and prints a code; the other player joins with qorcap pair join or Start Match --pair-code. Both write pairing.json beside the receipt, never inside it. contracts/compat.json is re-vendored from QorTime.
• PR #65: site copy for v0.3.30. The pad-identity check is local (the referee does not check the pad), the opt-in TPM device key is reported only as claimed or unverified, and the red-team missed and weak rows are listed.

qorcap.exe sha256 4482d63923ff55afcd7b54a8d6d7bfc05bd9225526d224649248151c2de21878