feat: add offline hidden Teacher distillation campaigns

[Alizen-1009]

Summary

Adds an opt-in offline teacher-distill campaign for generating an auditable naive-framework → hidden-Teacher optimization trajectory without changing standard campaign defaults.

Highlights:

• validates immutable Teacher bundles and builds a content-addressed, architecture/framework-scoped sanitized gpu-wiki view;
• keeps Teacher measurement and source in supervisor-private state;
• requires full correctness, multi-seed correctness, geomean/per-shape gates, and same-allocation A-B-B-A before SUCCESS;
• supports deterministic resume, one bounded long-horizon episode, and one bounded partial restart;
• builds deterministic evidence manifests and hypothesis-only distillation drafts without modifying canonical gpu-wiki/;
• hardens post-run Agent isolation, prompt filtering, external-search restrictions, private ABBA proof binding, monotonic Candidate acceptance, materialized-Teacher integrity, and escalation resume.

Validation

• python3.12 -m unittest discover -s teacher_distill/tests -v — 94 passed
• python3.12 -m unittest discover -s long_horizon/tests -v — 57 passed
• focused standard/runtime regression suite — 83 passed
• gpu-wiki query + self-containment — 95 passed
• Python compileall, JSON schemas, shell syntax, Markdown links, and git diff --check — PASS

Full local tests/ discovery ran 166 tests. Remaining failures are independently reproducible on upstream/main:

• test_local_gateway.LocalGatewayTest.test_rejects_unsafe_file_path_and_unsupported_kind (expected 501, current main returns 422)
• test_optimize_dispatch.OptimizeFrameworkDispatchTest.test_production_explicit_framework_disables_conversion (expected convert_after=0, current main passes 3)
• test_aggregate_dispatch cannot import because this local Python 3.12 environment lacks Torch.

Review notes

• This is hidden-audited, not a security-grade sandbox; the threat-model wording is explicit.
• Canonical gpu-wiki/ is never changed automatically. Generated drafts require human review and gpu-wiki CI before promotion.
• A full real-GPU end-to-end Teacher campaign remains unchecked in tasks/todo.md; mocked CLI/supervisor E2E and the individual real-GPU GDN kernel experiment were completed separately.

This PR is opened as a draft for maintainer review.