Implement immutable external-web-v1 scope and cumulative worker budgets #26

This implements the safe-profile prerequisite of CompleteTech-LLC/complete.tech#17 and #59. The current r2-header-v1 header screening remains unchanged; an expanded agreement must not be enabled using that implementation alone.

Acceptance:

• Add an immutable executable external-web-v1 manifest with an exact SHA-256 bound to displayed acceptance, selected same-host HTTP/80 and HTTPS/443 services, frozen jobs, claims and results. Unknown/missing/changed profiles fail closed.
• Reuse the existing Checker and network/worker machinery for only bounded public robots/homepage/header observations and verified TLS metadata. Explicitly label runtime/backport confirmation, internal configuration and compromise investigation as manual or separately authorized; no exploit, suspected-shell, secret-file or arbitrary-path probes.
• Enforce cumulative upper bounds across attempts/recovery: 100 HTTP, 20 additional TLS-only checks, 600 active seconds, 5 MiB bodies, 256 KiB decompressed per response, 32 KiB headers, 10-second request deadline, at most two transient retries, one connection and one request/check per second. Conservatively reserve bytes/time before each admission; lost leases do not refund or reset budgets. A stricter zero-automatic-retry implementation is permitted and must be disclosed.
• Preserve strict public-address/peer pinning, TLS/Host/SNI, robots, cancellation/expiry, one-second admissions, key isolation and the narrower legacy profile/wire format.
• Stop on possible sensitive/compromise indicators without persisting raw contents; retain uncertainty and exploitability=not_tested.
• Add meaningful Python/PHP/database and owned disconnected fixture evidence, including malformed bindings, budgets, gzip/header/slow-response limits, concurrency, revocation and recovery.
• Remain disabled by default. This source work does not publish an agreement, grant customer authority, provision production, or enable scanning. Site persistence and coordinated adoption are separate reviewed dependencies.

Depends on PR #25 for the maintained report/closure foundation. Final integration must refresh against current main, pass exact-head CI and two new independent fresh-context reviews. No customer target or production operation is authorized by this issue.