Signed controls config.

Narrow, signed config-integrity object. Captures which checks the harness ran, at what bundle version, with what per-surface tier ceilings, and which native agent-host configurations were active at run open. The verifier reproduces tier ceilings from this manifest at verify time — tampering is detectable.