Add governed TESSER LAB evidence launcher

[SemeAIPletinnya]

What changed

• adds an installable Windows TESSER LAB launcher for the dedicated T: volume;
• installs a clean Git-tracked runtime and an isolated pinned SaC/PoR authority checkout;
• adds manifest-driven evidence inventory without ingesting content or changing admission state;
• supports clean fast-forward runtime updates and withholds dirty, ahead, or diverged updates as NEEDS_REVIEW;
• isolates the lab runtime on loopback port 8775 so development on 8765 remains distinct;
• adds launcher contract tests to Windows CI and documents the installation flow.

Why

The existing development worktree contains local candidate changes and private evidence. It must not be used as an auto-updating installation. The launcher separates development, runtime, evidence, and release authority while keeping Git updates deterministic and reviewable.

Validation

• PowerShell parser: PASS for all launcher scripts/modules
• launcher Git contract test: PASS
• Python suite: 45 passed, 1 skipped
• public repository audit: PASS
• installed T: runtime health: tesser-studio on http://127.0.0.1:8775
• authority pin verified at a0f8103935cd557b88e00a3f4965a8604d50c040

Governance

Generation remains non-authoritative. Evidence inventory is advisory metadata and remains RAW_UNADMITTED unless separately admitted. SaC/PoR remains the final release Gate and is pinned for manual review rather than updated alongside UI/runtime code.