Qualify RAC1 CSI freshness, provenance, privacy, and retained physical evidence #1950

Confirmed post-merge finding

PR #1944 adds a bounded RAC1 parser and reachable UDP → state → REST path, but the merged diagnostic surface does not yet meet the frozen production-evidence gate.

At current main 45fc41ac4cb4fae4310e76351bcac2469101608b:

• /api/v1/csi/realtek/latest retains and returns a snapshot indefinitely without receipt time, age, stale/offline status, replay/sequence enforcement, or expiry.
• the public hardware-versus-simulated label is derived from unauthenticated packet metadata; CRC proves integrity, not origin.
• frames marked invalid can still be summarized and broadcast; undocumented flag bits and invalid decimation values are not rejected.
• the latest route exposes peer/trigger MAC addresses verbatim when network binding is enabled.
• the benchmark labels a minimally recognized frame MEASURED without validating the full RAC1 parser contract, and the physical firmware/capture/log artifacts needed for independent replay are not retained in the merged tree.

Raw I/Q is correctly discarded after bounded summaries, loopback remains the default, and no memory-safety defect was confirmed. This issue is therefore public correctness/privacy qualification, not a critical-vulnerability disclosure.

Acceptance criteria

• Include received_at, age, and an explicit fresh|stale|offline state; expire or clearly invalidate old snapshots.
• Reject or quarantine replayed/out-of-order sequence values under a documented wrap policy.
• Enforce csi_valid, known flag bits, decimation bounds, and maximum-size cases before state mutation/broadcast.
• Mark origin as unverified unless bound to an authenticated source; never infer hardware origin from a payload flag alone.
• Redact or pseudonymize MAC addresses on network-visible routes, or document and enforce a local-only privacy contract.
• Retain firmware source/version, serial log, capture/checksum, exact command, hardware topology, and an aggregate replayable result artifact.
• Make the benchmark use the production parser and validate CRC/version/length/validity before assigning an evidence class.
• Add fuzz/property tests and an end-to-end UDP → REST freshness/replay regression.
• Run post-merge workspace, audit, container, and CSI-policy gates on the exact remediation head.

Related: PR #1944 / ADR-323. No autonomous merge.