Harden receipt trust, coverage, and documentation

[plancherb1]

What

• introduce schema 3 with signed signer identity, exact collection/session outcomes, atomic receipt writes, multi-GPU metadata, and strict JSON
• replace source hashing with a tracked manifest that covers modes, symlinks, gitlinks, generated inputs, and explicit receipt exclusions
• add open contributor and restricted signer policies, strict policy/schema validation, test manifests, scope pinning, and clean-tree/ancestry checks
• harden sharding and carry-forward, reject xdist receipt workers, and preserve generated shard inputs
• expand the hermetic suite from 80 to 224 tests with enforced 100% line and branch coverage
• rewrite the README/docs/security/agent guidance around the same local-attestation story and add CI, package, coverage, and documentation gates

Why

The prior implementation and documentation had several fail-open or ambiguous edges: receipt emission could fail without failing pytest, tracked-only source scope could be empty or omit generated inputs, signer metadata was not fully bound into the signature, setup/teardown and session failures were incomplete, policies were loosely typed, and a whole-tree default would be self-referential for a tracked receipt. The docs also described old schema/default behavior and did not clearly separate signer attestation from hardware execution proof.

Impact

This is the planned 0.4.0 hardening release. New receipts use schema 3 and default to the full tracked repository while excluding gpu-proof.json explicitly. Schema 1/2 verification remains for migration. Schema 3 is clean-tree by default, missing signing or receipt-generation prerequisites fail pytest, and xdist workers must be replaced by separate shard processes. Repositories can keep contributor-signed PRs through open mode or select restricted username/key allowlists.

Checks

• coverage run -m pytest tests -q — 224 passed
• coverage report --fail-under=100 — 100% line and branch coverage (1206 statements, 454 branches)
• mkdocs build --strict — passed
• python -m build --no-isolation — sdist and wheel built
• python -m twine check --strict ... — passed
• isolated wheel CLI/import/pytest-plugin smoke checks — passed
• git diff --check — passed

This PR intentionally changes only pytest-gpu-proof; GLASS and glass-paper follow-up changes are out of scope until this lands.