Define physical hardware certification protocol

[oratis]

Summary

• define L0-L4 hardware evidence levels and exact cohort boundaries
• specify safe install, lifecycle, suspend, network, graphics, media, peripheral, fault-injection and recovery tests
• define privacy-conscious signed evidence bundles and HCM promotion/blocking rules
• establish the first diverse PC, Intel Mac, T2, M1 and M2 lab cohort

Validation

• git diff --check
• documentation links verified in-tree

Dependency

Built on #7 because it documents the HCM v2 and virtual hardware matrix introduced there.

This PR deliberately does not claim that physical machines are already certified; it defines the evidence required before such a claim is allowed.

[oratis]

CI evidence: https://github.com/oratis/Andromeda/actions/runs/30536619705 completed successfully across formatting, Clippy, workspace tests, and Linux/macOS/Windows hardware probes. This documentation PR intentionally does not claim physical certification; it defines the evidence required for it.