Wire explicit local qualification lifecycle

[dovvnloading]

Summary

This PR advances the corrected open-source roadmap by wiring an explicit local/CI qualification lifecycle profile while keeping the normal Cortex application disabled by default.

What changed

• Add build_execution_lifecycle(...) with exact disabled / qualification profile selection.
• Require the qualification release gate, an injected coordinator factory, and a provider-health probe before the qualification lifecycle can become ready.
• Add bounded profile diagnostics to ExecutionLifecycle snapshots.
• Expose the profile/configuration only as an explicit build_preview_app(...) injection; the normal app supplies none.
• Preserve fail-closed behavior for missing configuration, unhealthy controls, malformed health results, and coordinator startup failures.
• Add a focused Phase 2 qualification-lifecycle ADR and update the parent ADR, evidence log, sandbox/provider/release ADRs, and qualification guidance.

Safety boundary

This slice does not discover worker packages, persist signing/trust material, create processes, bind brokers, add recipe routes, enable model tools, or add a host-process fallback. release_profile=official remains separate optional release hardening. A caller must deliberately inject the already-qualified controls for local/CI use.

Verification

• python -m pytest -q: 316 passed, 1 skipped
• python -m compileall -q main.py Cortex_Preview.py backend: pass
• git diff --cached --check: pass
• Existing pytest-asyncio deprecation warning remains pre-existing.

Next stage

Build the recipe-specific coordinator/request and trusted artifact-publication path behind this lifecycle boundary. No external reviewer, production key, or release organization is required for that open-source stage.

Scope note

The unrelated working-tree change to Cortex.pyproj was intentionally excluded.