feat: complete the usable BehaviorLock upgrade

[kiranmagic7]

Summary

This is the single consolidated BehaviorLock upgrade pull request.

• Retain verifiable raw evidence and use evidence first, non verdict review language.
• Isolate acquisition through an exact registry proxy while preparation remains on network mode none.
• Add trusted provenance verification, SBOM generation, trusted profile controls, and dormant signed release machinery.
• Expand bounded observations for DNS, UDP, listeners, descriptors, process lineage, ptrace, timing, canaries, sequences, import, and the no route sinkhole.
• Prove resource limits, tracer death handling, trace forgery rejection, containment, and ten run semantic repeatability.
• Add split privilege dependency review without pull_request_target.
• Add a four family inert benchmark, exact example, 30 second demo, operator runbooks, incident template, and usability journey.

Consolidation

This head contains all 48 DCO signed commits from the former stacked PRs #24 through #30. It also retains the useful documentation, BL600 behavior, and containment proof work from superseded PRs #10, #13, and #14. The pull request now targets protected main directly so it is the only active upgrade branch.

Safety boundaries

• No merge, tag, release, package publication, Marketplace submission, launch, or live malware execution.
• Protected main remains unchanged.
• The checked in protected main snapshot remains closed at 0 of 14 release gates.
• Release workflows remain dormant and fail closed.

Verification

• make check
• scripts/usability-check.sh
• Deterministic benchmark replay
• Documentation link validation
• Full gosec, go mod verify, and govulncheck under exact Go 1.25.12
• Hosted hardened Docker integration, Linux and macOS race tests, CodeQL, DCO, vulnerability scanning, usability journey, and no publish release dry run

Addresses #16, #17, #18, #19, #21, #22, and #23.

[kiranmagic7]

Owner authorized completion into protected main and consolidation to one branch. Fresh verification before merge: make check, build, usability journey, module verification, gosec with zero findings, govulncheck with no vulnerabilities, exact head CI, CodeQL, hardened Docker integration, and no publish release dry run all passed. The launch boundary remains closed.