Prepare stable 2.5.11 offline replay identity correction

[rmcdaniel]

Backport the offline replay evidence correction from #140 to exact published 2.5.10, preparing a separate 2.5.11 candidate. The command records its installed SDK identity, rejects mismatched or missing metadata, and labels other platform pins as declared instead of claiming installed-tuple proof.

Only the report, its tests/docs and release metadata change. Client, Worker and workflow replay files remain byte-identical to 2.5.10; pending Nexus producer changes are excluded. The shared Server reader and immutable corpus remain unchanged.

The appended command fixture records the actual published mismatched-identity failure. The corpus policy and all retained history fixtures are unchanged.

Local exact-wheel validation: Ruff and mypy pass; 165 replay/conformance/patch/corpus tests pass. Normally installed candidate CLI returns 0 for a matching 2.5.11 pin, 1 for a mismatch and 1 without installed SDK metadata, always recording honest identity/proof fields. Three regressions fail against normally installed 2.5.10. The final appended fixture also passes current source and fails published 2.5.10. Independent final-head source qualification is running.

Full source checks and a separately verified publication are required before adopting this candidate. Current stable 2.5.10 identity remains unchanged. Refs #139; source #140.

[rmcdaniel]

Final stable candidate 8cf7c82ef81ef9cb7faef39b817e77d710850ac1 / tree 73ee5aa2f2a3cc40872fcb1a2bf7fe02f1273858 passes 166 tests from its normally installed exact wheel, including the actual report-command corpus fixture. Real CLI controls return 0 for matching 2.5.11 metadata and 1 for either mismatched or missing metadata; all keep installed-tuple proof false.

Client, Worker and workflow files remain byte-identical to published 2.5.10. The corpus guard and historical fixtures are unchanged. Local wheel SHA-256 is 6e98c1854f19d9b2e4de6a6fc215d7c789a18c0f67a46ff0bd698b60c1b88e7e; this is candidate evidence, not a registry publication claim.

Final independent stable CI 38340618932 and source CI 38340526373 remain in progress. Publication waits for complete passing gates and a separate exact published installation check.

[rmcdaniel]

Final candidate 8cf7c82ef81ef9cb7faef39b817e77d710850ac1, tree 73ee5aa2f2a3cc40872fcb1a2bf7fe02f1273858, passes the complete independent stable CI run 38340618932, including integration and target-branch qualification. Public-boundary checks pass. Source #140 is merged at ec42efee1ef4ba60c6fc7f85d1463a6bcdc16da2, tree-identical to its completely qualified head.

Final installed candidate verification passes 166 focused report/patch/corpus tests and matching/mismatched/missing-metadata CLI controls. Published 2.5.10 fails the new actual report-command regression. Client/Worker/workflow hashes match 2.5.10 exactly; no pending Nexus producer or portable protocol change is included.

Affected consumers are users of the installed offline replay report. The shared aggregate already supplies its own verified installation receipts; its reader is unchanged. Existing runtime consumers and frozen qualification tuples need no incidental retuple for this report correction. Registry publication and a fresh normal 2.5.11 install remain the final delivery checks.