Add Phase 3 hardware validation harness

[jmcte]

Summary

• adds scripts/validate-phase3-hardware.sh for fail-closed notarized APW.app hardware validation
• documents the Phase 3 validation procedure and adds a report template that avoids credential capture
• requires operator-recorded cancel, denied, and timeout observations before writing the report
• automatically exercises an unsupported-domain request via --unsupported-url
• updates the native-only redesign and security posture docs to point to the hardware validation proof path

Related issue: #43.

The remaining acceptance criteria require running the script on a real notarized host, recording success plus cancel/denied/timeout/unsupported-domain error paths, and attaching the completed report.

Verification

• bash -n scripts/validate-phase3-hardware.sh - passed
• ./scripts/validate-phase3-hardware.sh --help - passed
• bash scripts/ci/run-fast-checks.sh - passed
• git diff --check - passed

Notes

• The validation script intentionally does not persist returned usernames or passwords.
• apw app install is run from the validated APW.app parent directory so the CLI installs the same bundle that passed codesign, Gatekeeper, staple, and entitlement checks.
• The generated report now fails closed unless the operator supplies the manual error-path observations required by issue Roadmap: real-hardware verification of Phase 3 broker on notarized build #43.

[pheidon]

Approved from Pheidon sweep. Phase 3 hardware validation docs/script changes are scoped, secret/fast/Rust checks are green, and the native Swift job is intentionally skipped for this non-native path.