Verify locked HTTP exchanges in Python with host bindings

[aruintelligence]

What changed

• Capture real loopback locked HTTP allow and suppression exchanges with synthetic fixtures, saved host expectations, evidence capsules, and a separately supplied fingerprint pin.
• Add a project-authored Python verifier that checks capsule integrity and signature, nonce, intent, profile, context, HTTP enforcement envelope, and final decision. It reports signed output hashes without executing HTML.
• Challenge the saved exchanges with 22 cases, including replay, tampering, foreign and revoked signers, changed envelope controls, and an unsigned outer HTML swap; upload the compact report from Enterprise Readiness CI.

Validation

• node scripts/check-http-exchange-python.mjs (22 cases)
• node scripts/check-evidence-capsule-python.mjs
• node --test --test-reporter=dot
• npm run api:stability && npm run upgrade:check && npm run compatibility:consumer
• npm run check:links, deployment and package surface checks, git diff --check

This is project-authored cross-runtime evidence on localhost fixtures, not an external witness or production certification.