feat: add TAG2 SDK and release HIL

[k1a11220]

Summary

• preserve firmware 0.9.10-0.9.12 compatibility on the existing TAG1 framing path
• add opt-in TAG2 negotiation for capable USB firmware, with native u64 device timestamps, per-frame CRC32, and canonical per-boot boot_id binding
• keep USB streaming in the supported DTR=true, RTS=false host state and add an observation-only DTR/RTS matrix to the release HIL
• make recording and HIL paths fail closed on silent or stalled readers, session changes, stale device backlog, timestamp/sequence discontinuity, malformed frames, and incomplete finalization
• add canonical TAG2 spec/vectors, replay provenance checks, documentation, and a content-addressed dual-hand HIL/soak evidence runner

This is stacked on #4 (codex/public-release-automation). It contains no release-automation diff relative to that base.

Compatibility and safety

• Firmware 0.9.10-0.9.12 continues to select TAG1; TAG2 is negotiated only when CONFIG advertises support.
• TAG2 is USB-only. Recorded TAG2 metadata without a canonical boot_id, or TAG2 metadata claiming a non-USB transport, is rejected.
• The normal USB streaming state is DTR=true and RTS=false. The HIL line-state matrix is explicit and observation-only; this runner has no firmware flashing primitive.
• Stalled-reader recovery records a pre-stall seq/u64/boot/status boundary, resets host input, separates stale backlog, and validates the first fresh post-stall seq/u64/latency without accepting a rebooted session.
• KeyboardInterrupt and SystemExit seal failed/incomplete HIL evidence before the original exception is re-raised.

Verification

• uv run python -m pytest -q: 542 passed, 10 deselected
• focused HIL/TAG2/replay/USB suite: 150 passed
• workflow policy, Python compile, YAML parse, and every workflow run block under bash -n: passed
• python -m build: wheel and sdist built
• twine check: wheel and sdist passed
• diff/package-content checks: passed

Not yet executed

No physical hardware was accessed for this PR. The physical dual-hand HIL, live stalled-reader recovery, and explicit 72-hour soak have not been executed. The tooling and evidence gates are ready, but this PR does not claim physical-device or 72-hour release-pass evidence.