Qualify the durable recipe coordinator with the signed worker

[dovvnloading]

Summary

This PR closes the Phase 2 durable-coordinator implementation gate by running the durable image-recipe coordinator through the packaged, signed native worker.

It adds:

• A Windows-only qualification probe at tools/execution_spikes/recipe_coordinator_e2e_qualification.py.
• A qualification regression test proving the probe blocks safely without native Windows or a worker package.
• A Quality workflow step that runs the strict coordinator corpus after packaged-worker release qualification.
• ADR/evidence updates documenting the completed stage and hosted result.

What the probe proves

In one disposable coordinator instance it:

1. Signs and installs one immutable worker generation with an in-memory ephemeral key.
2. Stages bounded PNG bytes through AttachmentStagingService.
3. Completes a real AppContainer/broker/client transform and verifies result digest, MIME, size, dimensions, and atomic publication.
4. Rejects foreign-owner metadata and execution access before launching a worker.
5. Expires and purges a one-second attachment.
6. Cancels an in-flight resize transform and verifies no result artifact or temporary staging directory remains.
7. Verifies native worker/process and disposable workspace cleanup.

The probe is bounded, redacted, qualification-only, and has no host-process, in-process, or alternate-transport fallback. Normal Cortex startup remains disabled by default.

Validation

Local:

• python -m pytest -q: 342 passed, 1 skipped.
• python -m compileall -q main.py backend tools tests: passed.
• python tools/generate_contracts.py plus generated-contract diff: passed.
• Frontend lint, typecheck, 41 tests, and production build: passed.
• Ruff and git diff --check: passed.
• Strict Windows coordinator corpus: passed for transform, owner isolation, retention, cancellation, atomic publication, and native cleanup.

Hosted:

• Final Quality run 30467455657 / job 90628811567 passed every Python, frontend, packaged-worker, coordinator, and Windows packaging check in 4m12s on commit c022f51.

This is a follow-up to merged PR #63; it does not change normal application enablement or require production trust material.