feat(ctxpkg): release checkpoint layer in v3.10.0

[yvgude]

Summary

• add fail-closed signed .ctxpkg v2 checkpoint layer
• align bounds and canonical Engine bindings with SDK contract
• release new backward-compatible public mechanism as Engine 3.10.0
• split verifier tests/text helper into submodules for LOC gate
• preserve byte-stable signed OCLA contract pack
• keep moved addon fixtures reverse-cut neutral

Scope

Mechanism only: no SDK product lifecycle, commercial policy, Cloud, or private research code.

Verification

• focused core::context_package: 120 passed
• exact reverse-cut gate and moved addon fixture test: PASS
• cargo clippy --all-features -- -D warnings: PASS
• cargo fmt --check: PASS
• LOC gate: PASS (verify.rs 1489 lines)
• full delivery/security gate: PASS (OCLA 18/18, manifest/evidence, rehearsal, open-core, pytest, history)
• SDK/package version coupling: PASS
• release tag v3.10.0 check: PASS
• history policy: 0 new findings
• independent split review: PASS

SemVer

Minor bump: new backward-compatible public package mechanism.

Supersedes #1606-#1609 without force-pushing.