[piroyoung]

Summary

• add ADR 0067 and the inert clean-close certificate with checked lifecycle transitions
• preserve manifest V1 bytes while rejecting clean state from the V1 encoder
• add an independent, canonical 256-byte manifest V2 codec and exhaustive golden/failure coverage

Validation

• cargo test --workspace --all-features --locked
• cargo clippy --workspace --all-targets --all-features --locked -- -D warnings
• cargo run --locked -p ntsql-architecture-check
• cargo run --locked -p ntsql-contract --bin ntsql-governance -- fixtures
• cargo run --locked -p ntsql-contract --bin ntsql-governance -- provenance-offline
• cargo run --locked -p ntsql-contract --bin ntsql-governance -- provenance-online
• git diff --check

Refs #186