fix: harden snapshot loading and pre-collector registry semantics

[XiaojuCH]

Problem

Before the first real Windows Collector, the draft Snapshot reader had no file-size ceiling, constructed the current Snapshot type before explicit document routing, and only checked that captured_at was non-empty. Registry startup evidence also needed stable view labels and correct structured RunOnce prefix semantics.

Scope

• cap CLI Snapshot inputs at 64 MiB with metadata preflight and a bounded MAX + 1 read
• route systemdiff.snapshot v1 by document_type and schema_version before constructing the full Snapshot
• validate captured_at with standards-based RFC 3339 parsing and require known UTC (Z or +00:00)
• define stable, process-bitness-independent RegistryView semantics
• distinguish Run and RunOnce evidence and model documented ! / * behavior without stripping the full value name
• update synthetic fixtures, architecture/data-format/Collector/threat-model docs, and durable project state

Important design decisions

• The input ceiling is fixed and synchronous; this PR does not add streaming, async, or a configurable resource-policy framework.
• Header routing lives in core so future frontends can share it; filesystem bounding remains in the CLI transport boundary.
• captured_at remains the original wire string. Readers accept known UTC and reject RFC 3339 -00:00; future SystemDiff writers will emit canonical Z.
• Registry32 and Registry64 require explicit WOW64 selectors. Native is reserved for a sole view where no WOW alternate logical view exists.
• RunOnce prefix interpretation uses one enum. Combined, repeated, and marker-only forms remain undocumented; Foo, !Foo, and *Foo retain distinct identities.
• time 0.3.55 is added with default features disabled and only RFC 3339 parsing support enabled (Apache-2.0 OR MIT).

Authoritative Windows references

• Run and RunOnce Registry Keys
• RunOnce Registry Key
• Registry Keys Affected by WOW64
• Accessing an Alternate Registry View
• Registry Key Security and Access Rights

Validation

• cargo fmt --all --check
• cargo clippy --locked --workspace --all-targets -- -D warnings
• cargo test --locked --workspace --all-targets — 39 passed, 0 failed
• all three existing CLI smoke commands
• deterministic Diff regression coverage
• git diff --check
• modified-document relative Markdown link check
• independent reviewer: 0 High, 0 Medium, 0 actionable Low findings

Explicit non-goals

This PR does not implement a real Registry/Services/Scheduled Task Collector, systemdiff snapshot, Windows Registry API calls, Scheduled Task raw XML redesign, streaming JSON, machine/SID identity, risk integration, MSRV policy, GUI/Tauri, or release tooling.

Closes #3