Report installed SDK identity in offline replay conformance

[rmcdaniel]

The offline replay command can report a caller-supplied Python version as its implementation identity and claim a complete installed platform tuple from version/channel declarations. This occurs with normally installed 2.5.10 while declaring SDK 2.5.9.

Read the installed distribution version independently, record both identities, and fail mismatched pins or missing metadata with named diagnostics. Matching SDK declarations still pass replay, while the platform tuple is explicitly declared and its installation-proof booleans remain false. The aggregate runner supplies its own installation receipts; its shared reader and fixtures are unchanged.

Append the actual published command/report reproduction to the Python corpus. Its candidate result passes while normally installed 2.5.10 incorrectly returns pass for the mismatched identity. Existing history fixtures, the corpus policy and shared reader remain unchanged.

Validation: Ruff, mypy and 91 focused replay/conformance/corpus tests pass. Three metadata regressions and the new command fixture fail against normally installed published 2.5.10. An installed candidate wheel's real CLI returns 0 for matching metadata, 1 for a mismatch and 1 when SDK distribution metadata is absent, recording the actual identity and no tuple proof in all cases. Hosted corpus qualification passes on the final head; remaining full source checks are running. No workflow replay semantics or package version change.

Refs #139.

[rmcdaniel]

Final head e5260abce8d51a191f284132719a7c995f330692 passes the complete CI run 38340526373, including Python 3.10–3.12, lint, package, regression corpus and integration. Docs and public-boundary checks also pass.

Review confirms only the report, docs, Python tests and appended command reproducer change. The guard and retained history fixtures are unchanged. The actual command fixture passes current source and fails normally installed published 2.5.10 on its false pass. The separately installed stable candidate also passes that fixture and matching/mismatched/missing-metadata CLI controls.

This source merge does not publish the pending main capability work. The compatible stable correction remains separately qualified in #141.