Bind installer artifacts to platform identity

[oratis]

Summary

• bind each payload and ISO to a machine-readable platform variant, architecture, boot provider, HEP ID, digest, and checksum
• reject Apple hardware, architecture mismatches, boot-provider mismatches, and payload identity mismatches before installation
• require virtualization before the destructive CI installer can partition a disk
• run the same platform preflight for interactive installs and cover the guard with 11 fixtures

Validation

• full ShellCheck for OS scripts
• ANDROMEDA_PLATFORM_GUARD_TEST_OK cases=11
• stacked on Expand hardware coverage and certification #7 so the hardware baseline remains independently reviewable

Scope

This PR creates the safety and artifact identity boundary for separate PC, Intel Mac, T2, and Apple Silicon release lines. It does not claim Mac support.

[oratis]

Final E2E evidence: https://github.com/oratis/Andromeda/actions/runs/30536367639 completed successfully. The exact head SHA passed payload/ISO build, platform identity manifest and OCI-label cross-checks, guarded installation to a blank 64 GiB UEFI disk, first boot, desktop checks, v2 update, v1 rollback, three virtual hardware profiles, evidence upload, and installer upload.