Add Q8B proof-data acquisition and offline cache gate

[acedward]

Summary

• add exact Q8=B proof data: 20 raw K0-K19 payloads plus one deterministic Ledger-static-9 archive
• unify Ledger semantic identity with the warehouse file-only path-sorted member manifest while retaining ZIP layout separately
• bind K0 provider and K1-K19 trusted-setup generations/root-PoT explicitly
• require a reviewed Q8B admission contract and independently configured combined-generation digest at bootstrap
• retain exact architecture/version-bound rc.7/static-10 propagated-path rejection evidence instead of accepting generic exits
• preserve atomic named-volume bootstrap, two rc.5 readers, Compact 0.34 v2/v3, and real deterministic-input stock-AA K19 gates

Local verification

• scoped Docker generator/catalog/workflow/full suite: 33/33 passed
• scoped proof-data Docker suite: 9/9 passed
• actionlint 1.7.12, Python compile, JSON and diff checks passed
• companion warehouse PR: Pin canonical Ledger proof-data identity effectstream/binaries#6, local 43/43 and hosted CI passed

Exact-head hosted verification

• Forge policy run 33170546619 passed
• Compact run 33170546586 passed source and all four native Linux/macOS lanes
• Q8B run 33170546601 passed acquisition, amd64 runtime, arm64 runtime, and real stock-AA K19 proof
• retained artifacts: Q8B 9685464135; amd64 runtime 9685493146; arm64 runtime 9685489972; stock K19 9685772488
• stock K19 returned /k=19 and passed /check plus /prove from generation b73584978fc560bb827fd9df3ad914b37a6f5ea434fe62e9fa0adad809d8486c; K18 remains truthfully not-applicable

No release is published and no live demo is modified by this PR. Do not merge until the fresh independent audit of this PR and effectstream/binaries#6 passes. Owner redistribution acceptance remains the separate Phase-8 pre-upload gate.