[FLO-3.5] Integrate pinned Optiflow v0.1.1 read-only adapter

[szmyty]

Closes #50

What changed

• Pin the immutable, independently verified Optiflow v0.1.1 release by source revision, target archive, and executable SHA-256. Probe exact executable bytes and version before use.
• Add a public Flow library adapter for native optiflow.command-result.v1 scan → report → exact-duplicate review plan. It directly supervises the pinned child with bounded streams and deadlines, clears the environment, disables config/media probing, and checks selected root and filesystem identity.
• Independently verify committed artifact-set markers, member digests, schemas, paths, coverage, exit status, and review-only plan safety. Persist flow.optiflow-read-only-receipt/v1 before launch and after each transition. Reopening rechecks artifact bytes; interrupted work never becomes a completed attempt.
• Expose dry-run, quarantine, restore, and finalization as distinct unsupported capabilities. Record logical duplicate bytes separately; approval and physical savings remain absent.
• Add synthetic clean-room fixture, receipt schema, operator guide, compatibility matrix, architecture decision, and roadmap handoff. Existing generic JSONL and durable graph contracts remain unchanged.

Local validation

• Rust 1.85: cargo test --locked — 189 passed, 2 existing subprocess entrypoints ignored. The lifecycle corpus and acceptance matrix ran within this suite.
• FLOW_OPTIFLOW_V011_EXECUTABLE="<verified release executable>" cargo test --locked --test optiflow_read_only — 3 passed on synthetic text inputs with Unicode paths; verified unchanged source bytes, refusals, interrupted receipt reopening, and artifact tamper detection.
• cargo clippy --all-targets --locked -- -D warnings, cargo fmt --check, git diff --check, and all three repository-local validators passed.
• Verified the downloaded release bundle and Linux executable SHA-256; validated a receipt produced by the real release against the new JSON Schema. Published GitHub branch tree matches the validated local tree exactly (4107f4495097e7b2113670ba89fa9eff738582dd).

Boundaries

Linux x86_64 was run locally. macOS archives/executable digests are pinned, with native execution still unverified. No hosted CI was awaited; no personal media was scanned. This release grants no mutation authority. Flow #73 is the later v0.2 mutation adapter, and #53 will compose released adapters into the suite CLI.

[szmyty]

Fixed the failed Lint all targets step from run 36332338830. Clippy on Rust 1.98 flagged byte-by-byte reads of the Optiflow child stdout/stderr (clippy::unbuffered_bytes). The adapter now uses bounded read_to_end on each capped stream; the existing limit-plus-one sentinel and overflow refusal remain in place.

Local validation with Rust 1.98.0: cargo fmt --check; cargo clippy --all-targets --all-features --locked -- -D warnings; and the three optiflow_read_only synthetic tests with the pinned release executable. All passed. git diff --check passed. The published head is 15aaba321b7ebf9181a54a9bf74c0f4eebc0cb15, with tree 67ac0a4e2ed32bb3e5185bbe2418f4e6db680cd3, matching the validated local tree. Hosted CI was not polled.