fix(module): make pin verification hermetic

[rldyourmnd]

Outcome

Makes the public module verifiable from a clean GDS consumer checkout.

• adds checksum-pinned uv bootstrap
• uses exact Python 3.13.14 with venv --copies
• installs hash-locked dependencies into an owned repository .venv
• runs the registered isolated package launcher
• cleans only the environment it created
• adds a blocking contract validator for the anchor/wrapper

Regression evidence

A fresh local clone with no .venv ran scripts/validate_module.sh, passed the complete core tier, removed the owned environment, and finished with a clean worktree.

Verification

• bash -n scripts/validate_module.sh
• shellcheck scripts/validate_module.sh
• validate_all.py --tier core
• clean-clone wrapper regression
• actionlint