fix: harden measurement artifact handling

[conikeec]

Summary

• add internal measurement checkpoint/resume for compatible interrupted runs
• include run IDs and per-artifact digests in measurement cache manifests
• clean abandoned in-progress evidence files before fresh measurements
• make side-effect snapshot caps configurable through measure/guard flags and record them in artifacts
• disclose hostile-binary containment as unsupported while preserving isolated-mode side-effect evidence
• update operational docs for cache, resume, scanner limits, and threat-model contracts
• add a command playbook for future hostile-binary containment validation and current evidence classification

Testing

• cargo fmt --all -- --check
• env RUSTC_WRAPPER= cargo clippy --workspace --all-targets --all-features -- -D warnings
• cargo test --workspace --all-features
• ./target/debug/cliare measure ./target/debug/cliare --out /private/tmp/cliare-self-audit-hardening --profile quick --refresh
• ./target/debug/cliare measure ./target/debug/cliare --out /private/tmp/cliare-self-audit-hardening --profile quick
• docker run --help flag inspection for documented Docker containment recipe
• sandbox-exec and dtruss local preflight checks documenting why they are not accepted containment backends
• jq classifier commands syntax-checked against /private/tmp/cliare-self-audit-hardening/evidence.jsonl