feat: add pinned eCAD hardware authorization foundation

[srpatcha]

Summary

• Add immutable eCAD pins for the exact repository commit, contract version, complete schema set, product bundle, and receipt.
• Validate all bundled v1 documents against pinned local schemas and reject remote schema resolution.
• Independently recompute V0-V4 verdicts, execution completeness, eligibility, product-scoped requirement coverage, gate assignment, evidence bytes, and provenance.
• Reject dirty sources, moving references, tampering, schema drift, unsafe paths, unrecognized tools, and every required non-pass result.
• Provide an authorization-before-generation callback API; denial cannot invoke generation or mutate existing output.

Validation

• python3 -m pytest tests/unit/test_hardware_validation_gate.py -q — 34 passed.
• Actual clean eCAD product bundle from feat: define v1 hardware validation contracts and strict results eCAD-Hardware-Products#30 verified structurally and was denied only for genuine non-pass V2-V4 checks.
• Complete repository suite: 707 passed, 4 skipped, 10 pre-existing failures.
  • 1 failure: local Python environment lacks the ninja package.
  • 9 failures: baseline PackageRecipe lacks to_dict() in index-sync tests.
• Independent code review: clean after remediation.

Scope boundary

This PR delivers the verifier and authorization foundation. Parent issue #156 remains open for wiring every public generator, explicit BOM/controller role mapping, atomic output publication, and downstream generation receipts.

Related work

• eCAD contract producer: feat: define v1 hardware validation contracts and strict results eCAD-Hardware-Products#30

Fixes #157
Part of #156