fix: attest observed qualification capabilities

[abrichr]

Outcome

Desktop now derives qualification runner capabilities from the exact retained Flow run report instead of copying operator-declared requirements.

What changed

• collect a typed, PHI-free capability observation from actual resolution, actuation, identity, postcondition, effect, profile, and substrate evidence
• bind the observation to the exact workflow, project revision, environment, case, run, runtime, and raw report hash
• sign and retain the observation beside the existing run-report receipt
• require the signed receipt hash in the signed qualification case result
• show required, observed, and missing capabilities in the qualification cockpit
• refuse Standard/Regulated certification, export, and deploy when current required cases lack observed capability coverage
• keep Demo behavior unchanged when no capabilities are required

Verification

• 602 passed full Python suite with isolated HOME
• 30 passed focused qualification/dispatcher integration suite against bundled openadapt-flow==1.23.0
• 26 passed full frontend suite
• TypeScript/Vite production build passed
• Ruff and diff checks passed
• wheel and sdist built and independently inspected by verify_build_artifact.py

No openadapt-flow edits and no Desktop release are included.