P7.6 #446: fail-closed field diagnostic qualification intake, no physical promotion

[masarray]

Stacked draft child of P7.5 PR #476 at exact head 7384de375aad981b4dd75cf5d8c947d72dd4e656. Coordinated by #446. Does not modify P7.5's branch, WPF runtime, ARIEC61850 pin, MMS reporting or release/physical authority.

Work

• New read-only offline Python verifier of native full Copy Diagnostic for an exact IED: explicit semantic MATCH and exact fingerprint per Discovery/Open SCL, independently routed BRCB and URCB, full untruncated target list, selected-signal minima, accepted real per-target ROUTED status, nonempty binding identity and timestamps. Fail closed on incomplete, ambiguous or untrusted detail.
• Strict eight-target diagnostic ceiling: native Copy Diagnostic prints only first eight per ingress. Never claim full traffic parity if required detail is hidden; do not fabricate network/physical evidence.
• 16 sanitized positive/negative fixtures. Existing R7 interoperability Windows CI runs Python safety tests early; no new workflow or native build.
• Document manual real-IED and independent PCAP checks in docs/audits/P7_6_FIELD_QUALIFICATION_INTAKE.md. Output is explicitly DIAGNOSTIC_CONSISTENCY_PASS_NOT_PHYSICAL_VERIFIED, never PhysicalVerified or release permission.

Safety, ownership, promotion

This is software CodeVerified qualification tooling only. Still require real 7SX85 two-ingress BRCB/URCB and J/F AP physical retests with controlled PCAP and no cyclic polling. Keep this PR DRAFT and stacked until P7.5's physical evidence and orderly branch integration authorize promotion. Does not touch or merge PRs #425/#454/#459/#466/#471/#473/#476. Scrub customer diagnostics; never upload private SCDs or PCAP unredacted. Source/engine/physical R10 acceptance remains unchanged.