Harden Sampled Values profile analysis for live integration

[masarray]

Purpose

Close correctness and safety gaps in the Sampled Values profile infrastructure before wiring it into live capture, PCAP import, SCL comparison, or Subscriber UI.

Completed changes

• Separate MAC-address normalization from svID and dataset-reference comparison so punctuation cannot create false identifier matches.
• Add evidence-maturity confidence ceilings: research candidates cannot appear stronger than Possible, and generic implemented profiles cannot appear stronger than Likely.
• Preserve raw detector confidence separately from maturity-gated public confidence.
• Replace the unbounded observation list with a thread-safe bounded rolling window.
• Add configurable maximum observation count and maximum age.
• Classify sequential, gap, duplicate, out-of-order/reset, and confirmed-wrap counter transitions separately.
• Require a zero transition with sequential recovery before classifying a backward transition as a wrap.
• Add explicit provenance for wire-observed, capture-calculated, SCL-derived, and trusted-context facts.
• Add deterministic tests for false identifier matches, maturity ceilings, bounded windows, observation aging, duplicates, gaps, out-of-order/reset behavior, confirmed wraps, and provenance.

Validation completed

• CI: success.
• Public terminology validation: success.
• Public-site generation and recursive validation: success.
• Locked NuGet restore: success.
• Publisher and Subscriber warning-free builds: success.
• Full deterministic test suite and coverage gates: success.
• Dependency vulnerability reports: success.
• CodeQL full-solution analysis: success.
• Windows portable applications: success.
• Installer compilation: success.
• CycloneDX SBOM validation: success.
• Silent installer/uninstaller smoke test: success.
• SHA-256 generation and private workflow artifact: success.
• Public release job on the PR: correctly skipped.

The branch started before unrelated licensing, Pages, and dependency updates landed on main; GitHub's merge uses the current main, and the changed engine/test paths do not overlap those updates.

No WPF integration, named-profile claim, or public release is included.