Validates bounded clean-room observations for candidate and exact-public package proofs.

Shell adapters own package fetching and generated-host execution. This module accepts only the closed, low-cardinality result of those operations and refuses incomplete package/profile sets, shared scratch state, source substitution, or vacuous profile success.