fix(converter): fail closed without transaction evidence

[VincentAdamNemessisX]

Summary

• bind core and system write success to the authorized dry-run source/target/output hashes, exact output path, manifest, and conditional backup evidence
• validate operation-specific ExtData staging/install, CEC, compatibility-repair, and rollback reports against the Rust CLI schemas
• reject status-only, malformed SHA-256, duplicate component, wrong path/hash/manifest, and stale-domain evidence while revoking only that domain authorization
• preserve new-target exports without inventing a backup and treat repair no-changes as a distinct evidence-backed completion

Passed locally

• swift test --package-path apps/mh3g-save-converter-macos: 63 tests, 0 failures
• swift build -c release --package-path apps/mh3g-save-converter-macos: PASS
• cargo test -p mh3g-save-convert: 205 tests across 8 suites PASS
• focused write_then_rollback_restores_previous_slot: PASS with source-byte/source-SHA invariance and restored-target SHA assertions
• cargo fmt --all -- --check: PASS
• git diff --check: PASS

Blocked / Unverified

• Hosted GitHub Actions terminal success is Unverified while the ongoing Actions incident is unresolved; no queued/no-check state is claimed green.
• No user save, GUI, device, emulator, ADB, or production runtime was touched.

Stack

• Base is Save Sync Apple Design PR feat(ui): apply Apple Design state rails to Save Sync #33 exact branch. Merge feat(ui): apply Apple Design state rails to Save Sync #33 first, then this PR. Artifact-bound SBOM PR feat: bind release SBOM to exact artifacts #34 must rebase and rebuild from the eventual merged ref.