feat: build closed M0 research source snapshots

[Pigbibi]

Summary

• add an offline CLI to project a validated advisory report into a closed QRS-compatible M0 source snapshot
• bind every M0 hypothesis to the canonical advisory-report digest
• retain fixed research-only and no-order authority with deterministic source timing

Safety

• does not modify the publisher, existing public artifact, scheduler, platform, strategy, broker, or runtime
• the CLI performs no network or delivery action
• output is source data for later independent validation only

Validation

• local source-snapshot build and validation passed with PYTHONPATH=src python
• static compile and diff checks passed
• GitHub CI will run the four target tests and repository regression checks