GAL-2 Time Contract RC5.5 / 1.2.0-rc.1 change manifest

Scope:
This evaluator release preserves the RC3 and RC4 application-facing Time Contract model and carries forward the RC4-derived holdover behavior into the RC5.5 line.

Runtime deltas carried into RC5.5:
1. valid_until semantics anchored to last_good_sync plus contract_live_valid_sec while LIVE
2. explicit 72h holdover policy surface and contract-visible holdover metadata
3. explicit rejoin deadband and slew visibility
4. witness_ref present as IXOYE advisory-only reference
5. IXOYE does not affect safe_to_consume
6. doctor surface remains secret-safe and reports booleans only
7. quota visibility present in status and contract surfaces

Boundary:
macOS evidence includes LIVE, HOLDOVER, REJOIN, FAIL_CLOSED, and recovery behavior on the 1.2.0-rc.1 runtime.
Linux evidence currently includes evaluator install and Docker LIVE smoke on the 1.2.0-rc.1 runtime.