fix: harden public installation across Linux and WSL

[WindDAnalytics]

Summary

Hardens the public QuantumD installation path after clean WSL validation found
that Ubuntu 20.04 ships with unsupported Python 3.8 and may not provide a
matching python3.12-venv package.

Changes

• adds a guided Linux and WSL bootstrap using uv
• preserves exact TestPyPI wheel and SHA-256 verification
• documents one stable virtual-environment location and reactivation path
• adds WSL and Ubuntu 20.04 troubleshooting
• adds an explicit platform-support matrix
• tests Python 3.10, 3.11, and 3.12
• tests the public bootstrap on Ubuntu 22.04
• tests Ubuntu 20.04 through a container because GitHub retired its hosted image

Trust boundary

No signing, authorization, evidence, provider, or hardware behavior is changed.

The public bootstrap must still prove:

• LOCAL_DEVELOPMENT
• LOCAL_SIMULATION_ONLY
• hardware authorization is PROHIBITED
• IBM is not contacted
• KMS is not contacted
• the complete evidence chain verifies independently

Local acceptance

• source tests
• built-wheel public-alpha acceptance
• exact published-wheel bootstrap
• strict documentation build

[WindDAnalytics]

Follow-up hardening from compatibility CI and poisoned-environment validation:

• rewrites one multiline f-string so Python 3.10 and 3.11 can parse
  submission.py
• adds an explicit parser check before the regression suite
• removes inherited GCP/KMS configuration from public-bootstrap child commands
• requires exact local-development trust, KMS isolation, simulator-only scope,
  and hardware prohibition
• deliberately poisons the Ubuntu 22.04 CI environment to prove isolation

No evidence format, approval semantics, signing behavior, or hardware boundary
was weakened.