P6: security soak, axe a11y sign-off, signed air-gapped bundle tooling

- Concurrency soak (exit criterion): 12 concurrent gated runs, every
  decision attempted twice concurrently, explicit resumes racing the
  durable sweeper — exactly one execution per approval, grants consumed
  at most once, every decision audited, zero stuck runs, zero unaudited
  executions. (Testkit pool raised to 20 connections; the 5-connection
  pool starved the storm.)
- axe a11y sweep (exit criterion): serious+critical violations fail CI on
  login, shell, chat, computer home, settings app, all global pages, and
  the wizard. Two real violations found and fixed: aria-label on a plain
  div (wizard progress -> role=group) and a button directly inside a <dl>
  (settings -> plain bordered list).
- tools/bundler (exit criterion): keygen / assemble / verify CLI — copies
  artifacts, writes manifest.json + sha256 checksums.txt + a detached
  ed25519 signature; verification is fully offline (keyless signing is
  internet-dependent and disqualified). Tests: round trip, tampered
  artifact caught by hash, tampered checksum list caught by signature,
  wrong key refused, missing artifact reported.

147 Rust + 63 frontend tests + 27 Playwright journeys (incl. 4 a11y).

Co-Authored-By: Claude Fable 5 <[email protected]>

data/019eb186-c773-7cd2-b7c0-96c1512b750c/documents/019eb186-c86b-70f0-bdd8-ab56bfd0fe09/reports/q2.md

@@ -0,0 +1 @@
+Q2 revenue is up 14%.