feat(ctxpkg): release checkpoint layer in v3.10.0

[yvgude]

Summary

• add fail-closed signed .ctxpkg v2 checkpoint layer
• align bounds and canonical Engine bindings with SDK contract
• release new backward-compatible public mechanism as Engine 3.10.0
• split verifier tests/text helper into submodules for LOC gate
• preserve byte-stable signed OCLA contract pack

Scope

Mechanism only: no SDK product lifecycle, commercial policy, Cloud, or private research code.

Verification

• focused core::context_package: 120 passed
• cargo clippy --all-features -- -D warnings: PASS
• cargo fmt --check: PASS
• LOC gate: PASS (verify.rs 1489 lines)
• full delivery/security gate: PASS (OCLA 18/18, manifest/evidence, rehearsal, open-core, pytest, history)
• SDK/package version coupling: PASS
• release tag v3.10.0 check: PASS
• history policy: 0 new findings
• independent split review: PASS
• prior full local library run: 10,487 passed, 22 ignored, one /private/tmp path-jail artifact; same test passes from normal project path, so protected PR CI is authoritative

SemVer

Minor bump: new backward-compatible public package mechanism.

Supersedes #1606, #1607, and #1608 without force-pushing.

[yvgude]

Superseded before merge: full Ubuntu CI found two reverse-cut-sensitive historical fixture names after the test-module split. They are now neutralized without changing test semantics; the exact reverse-cut and addon tests pass. Clean replacement follows without force-push.